last executing test programs: 8m37.950804174s ago: executing program 4 (id=193): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000000f00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x58, r2, 0x73976972ba3f4b55, 0x0, 0xffffffff, {0x8}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x7, 0x4, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x0, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0x0, 0x7, {0x2, 0x2}}, @IPVS_SVC_ATTR_TIMEOUT={0x0, 0x8, 0x400}, @IPVS_SVC_ATTR_PROTOCOL={0x0, 0x2, 0x2f}, @IPVS_SVC_ATTR_ADDR={0x0, 0x3, @ipv4=@local}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7cb5}]}, 0x58}}, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_RESET(r3, 0x5000, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}]}]}], {0x14}}, 0xc4}, 0x1, 0x0, 0x0, 0x50}, 0x4000040) 8m37.360749511s ago: executing program 4 (id=195): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r3, {0xa, 0x9}, {}, {0xc, 0xe}}, [@filter_kind_options=@f_flow={{0x9}, {0x1c, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_MASK={0x8, 0x6, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18934}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x200008c2) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_MPATH(r1, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x4c, r4, 0x400, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x4c}}, 0x804) 8m34.686413882s ago: executing program 4 (id=201): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)={0x2, 0x0, [{0xf000, 0xee, &(0x7f0000000540)=""/238}, {0x0, 0x0, 0x0}]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYRES16=r1], 0x48) r2 = socket$alg(0x26, 0x5, 0x0) memfd_create(0x0, 0x5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x581, 0x20000000008c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0}, 0x18) syz_open_dev$swradio(0x0, 0x1, 0x2) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x50, 0x20}, {0x20, 0x0, 0x0, 0xfffff008}, {0x6, 0x8, 0x3, 0x3}]}, 0x10) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000180)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="05000001000000000000ff7eff00c237944eb5e6454280302c6f2ee79d1ce91e88e1da5714414898f6c542256e1e083628f20fe8fda1db83a7d2c4af10385e8a"], 0xe) 8m33.942953702s ago: executing program 4 (id=202): creat(&(0x7f0000000000)='./file0\x00', 0x108) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006340)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x1, 0xffffffff80000000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0xa4901, 0x0) write$tcp_congestion(r2, &(0x7f00000001c0)='yeah\x00', 0x5) dup2(r2, r0) 8m33.695447637s ago: executing program 4 (id=205): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x2b, 0x1, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000080200000e00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000040000000000000000000000070000"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7030000ec000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r2}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="17000000000000000084000001"], 0x48) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b3c094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000580)='tracefs\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r3], 0x0, 0x8, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r3}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r3, 0x40049366, &(0x7f0000000180)) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='memory.swap.events\x00', 0x275a, 0x0) write$binfmt_misc(r4, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r4, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 8m32.740449547s ago: executing program 4 (id=210): r0 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x901) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f00000002c0)={0x80000000, 0x0, &(0x7f0000002c40)=[{{0x80000000, 0x0}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000300)={r2, &(0x7f00000001c0)=[{}, {0x80000000}], &(0x7f0000000100)=[{{}, {0x80000000}}]}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r5, 0x0, 0xe, 0x0, &(0x7f0000000400)="75b9a58c68be0208beca252388f7", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000280)={r4, 0x0, &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f000000a300)={{r3, r7, 0x2, [0x40000020, 0x8]}, {r6, r1, 0x0, [0xc1b, 0x4]}, 0x0, [0x7e, 0x4]}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r8 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x1, 0x440) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r8, 0x40405514, &(0x7f00000004c0)={0x69ef3fd6, 0x5, 0x40, 0xa, '\x00', 0x9}) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r9}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r10 = getpid() sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r11, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r12, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r11, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$unix(0x1, 0x5, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r13 = socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) sendmsg$nl_generic(r13, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200488c0}, 0xc000) mount(&(0x7f0000000100)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000300)='gfs2\x00', 0x5, 0x0) ioctl$KVM_GET_SREGS(r9, 0x8138ae83, &(0x7f0000000640)) 8m17.228951045s ago: executing program 32 (id=210): r0 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x901) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f00000002c0)={0x80000000, 0x0, &(0x7f0000002c40)=[{{0x80000000, 0x0}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000300)={r2, &(0x7f00000001c0)=[{}, {0x80000000}], &(0x7f0000000100)=[{{}, {0x80000000}}]}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r5, 0x0, 0xe, 0x0, &(0x7f0000000400)="75b9a58c68be0208beca252388f7", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000280)={r4, 0x0, &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f000000a300)={{r3, r7, 0x2, [0x40000020, 0x8]}, {r6, r1, 0x0, [0xc1b, 0x4]}, 0x0, [0x7e, 0x4]}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r8 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x1, 0x440) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r8, 0x40405514, &(0x7f00000004c0)={0x69ef3fd6, 0x5, 0x40, 0xa, '\x00', 0x9}) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r9}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r10 = getpid() sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r11, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r12, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r11, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$unix(0x1, 0x5, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r13 = socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) sendmsg$nl_generic(r13, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200488c0}, 0xc000) mount(&(0x7f0000000100)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000300)='gfs2\x00', 0x5, 0x0) ioctl$KVM_GET_SREGS(r9, 0x8138ae83, &(0x7f0000000640)) 18.884659342s ago: executing program 0 (id=1624): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) add_key(&(0x7f0000000080)='dns_resolver\x00', 0x0, &(0x7f0000000100)="26c2", 0xfffff, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="130000001000000002000000000000000000000040f957945e66a5ec7fa73ba501ffc325ed3206b7adf519e9ee763fbb57dcbc5e0f2cb0dce02fb556ec21242acc89667147c765aa6595559a9b8ca2a1693974e1a6e77ca08ee8ddbb6b5414e7bcf4c257cada9d6c3ac08432cf12af93b1f6308e5b1fccfa746eddcd050e42d74351568102b1d9fd443015d2bed0049c6863e1948614a013ed3011c5c3380b5553cd6d3d39509ae4dc33b54a0358c3893a588dc59723c8c100020000000000003ee4bac0149e", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000180)={0x18}, 0x18) mount$9p_fd(0x0, &(0x7f00000025c0)='./file0\x00', &(0x7f0000002340), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0}, 0x18) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000023000000189c78a55cdd2f6c79b866aa80e1edb66f746f5f626f6e64000000"], 0x2c}}, 0x0) mount(&(0x7f0000000380), 0x0, &(0x7f0000000800)='9p\x00', 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1400000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0000060000005208f09fa54b3c6524044935143a272a00a0065365c27c61ff209c9ef175c59dd7649d9305cddc", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe93, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={0x0, r3}, 0x18) bpf$MAP_CREATE(0x300000000000000, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 13.516828087s ago: executing program 0 (id=1641): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) (async, rerun: 64) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@abs, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000001340)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000003c0)={[], [], 0x2f}) fsetxattr$security_ima(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000280)=ANY=[@ANYBLOB], 0xfe49, 0x0) (async) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) (async, rerun: 64) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) (async, rerun: 64) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r3 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_int(r3, 0x0, 0x13, &(0x7f0000000040)=0x7, 0x4) (async) bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) (async) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='macvlan0\x00', 0x10) (async) sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4e21, @remote}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000200)="08001efbb0", 0x5}, {&(0x7f0000000100)="d0849e99c27f53cd", 0x8}], 0x2, 0x0, 0x0, 0x60000000}, 0x20004044) (async) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2a, &(0x7f0000000600)=0xdfa, 0x4) (async, rerun: 64) mknod$loop(&(0x7f00000001c0)='./file0\x00', 0x2000, 0x1) (rerun: 64) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000240)={0x50, 0x0, r5, {0x7, 0x1f, 0x0, 0x202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}}, 0x50) syz_fuse_handle_req(r4, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101081, 0x0) 8.987134044s ago: executing program 0 (id=1649): ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x10001) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='contention_end\x00', r0}, 0x18) socket$packet(0x11, 0x2, 0x300) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000005640)=ANY=[@ANYBLOB="240000001400050126bc70007bdbdf2511000d000100053e3e"], 0x24}, 0x1, 0x0, 0x0, 0x8002}, 0x2005c840) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000000)="0900bf65653f47f4020000008bd458d1e7cbdaf300000f34e7e4165f081ae36850f6d15c3e681411f7a496c0da04003c242f5bedaf6bec340dee49474362b24cb800edc500", 0x0, 0x48) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) syz_open_dev$sndctrl(&(0x7f00000002c0), 0x0, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) 8.807107255s ago: executing program 1 (id=1652): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000005000100000000009d2b1800000000001840000002000000000000000000000005b0fcff000000009500000000000000fd03f87d323b0407731e44175bb38dd96a4934a21922ca385cddb5c989083f98aac35d8faa38db6751a117b48ad7ab76eaa0bba9ad63cf4b70d119967aa3e93a52aedce589b05095bd59050e4629b5d72440233b23c5d4df065d63dd18224a8010fafcc8875b3da7f168906a62a3f14fd122f1ff"], &(0x7f00000004c0)='syzkaller\x00'}, 0x94) r0 = getpid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/wireless\x00') ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, r0, 0x0, 0x4004) pread64(r2, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) 8.371627818s ago: executing program 1 (id=1654): r0 = syz_open_dev$video4linux(&(0x7f0000000680), 0x2, 0x109a80) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000080)={0x0, 0x0, {0x1, 0x0, 0x3012, 0x5, 0xd, 0x2, 0x2}}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x3, &(0x7f0000000140)=ANY=[@ANYRES64=r0, @ANYRES8=r0], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r1}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="c65d161dfff7ce6017dda0a5a5e6d3ca0c97767202834079ea2e95b79344d7ad5a70d16983d0513962a5efd95dcd21e1fd50098be068e47382223a356556941c2cc47bf5dc6f4f950a79576a9e4159062a2d75839458713daae067878369c5d016381e51730e198f21e1369a8deed9587cb0f164448b2b2bfd5ff94e468ace02b0a9d6b1b4eb2bd6b741617760ed09c80200abcb0087f8140a872da735f7", @ANYRESDEC=r2], 0x48) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x408401) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x0) syz_usb_connect$printer(0x2, 0x0, 0x0, 0x0) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:\a\x00\x00', 0x0) r6 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) readv(r4, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000480)='\xf5\xfc\xd2\xec]\x95zx8*\xa2d\x11\xb5\xb1\x01\x00\x00\x00\xe49{\x8a{\x81s\xea$\xdfg\xb1\x03DY!\x97\xadM\xd7\xff\x8a\xcd[>\x12e\xc3]d8\xba\x8ec\x00\x00\x00\x00\x00\x00\x00\xa0\xe2\xd5y\xec\x90\x00\x98Y\x91\x19\x16\x89\xd0\x1a\xad\xcd\xd6\xd0\xc6\xb9\xeb\x95\xd3\x9cl\x9cu#\xb4\xee\xe5\x9d\t\fV\xd4\xda\xfc`2?\x15P\xba\x14b\x1c\xcc\xd5\xb9jA$s\xb9g3\x15[\xc7\xec\xa9;\xee\x01\xc9\xc4\x1f\xc3\xe4\xfa\xd3fU\x0e\x86\xc8\xa7\xaf\xaf\x04P\xa3\x8bb\xbf\\\xdb\x83\x00\x96sy\x14\x1eo\xcc9&\x946\xf9\xf5v\xee\xb5m$;\x01\xb8\xeau\x00\xd1S=\x920H\xc2z\xb5\xbe\x95\xef\xeb\xd1\xc8\xa1\xba\xach\xbef\xa8\x86\xc2\x18\x9cC\x15\x9c^\xcf\xe9\xbcp\xb4Ff\x00\x9d>p\"\x19\xd8}|\x92\x13\x874\xe3\x01\xfd-?\xba\xf2\x8e\xa5y\\\xf0\fkd??-\x983\xf3\x19\xc7\xc0/\xe9\x1a\x80=\xa72)\xd2\x00'/272, &(0x7f0000000240)='/\t\x00\x00\x00\x98', 0x0) tkill(r6, 0xb) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 6.772986484s ago: executing program 1 (id=1657): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r3, 0x0, 0x48f, &(0x7f0000000000)={0x2c, @remote, 0x4e20, 0x0, 'none\x00', 0x32, 0x5, 0x3f}, 0x2c) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xa43, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_GET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000000914e73f"], 0x30}, 0x1, 0x0, 0x0, 0xbe9b70533f0d9e1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815001000ff05143a13600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f877501000100683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a9295cbcd8bee", 0xd8}], 0x1}, 0x0) recvfrom(r4, 0x0, 0x0, 0x20, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001380)={&(0x7f0000001440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x26, 0x26, 0x4, [@datasec={0x2, 0x1, 0x0, 0xf, 0x1, [{}], 'D'}, @datasec={0x0, 0x0, 0x0, 0xf, 0x1, [], "84"}]}, {0x0, [0x0, 0x5f]}}, &(0x7f00000014c0)=""/2, 0x44, 0x2, 0x1}, 0x28) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_GET_DEVICE(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x28, 0x0, 0x301, 0x70bd2c, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0xd0}, 0x20008000) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'veth0_to_bond\x00', 0x400}) openat$comedi(0xffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x0, 0x0) 6.5358793s ago: executing program 0 (id=1658): openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x1c0002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x18, &(0x7f0000000100)=ANY=[], 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) fchmod(r1, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip6_mr_cache\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=""/232, 0xe8}], 0x1, 0x4, 0x5) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r3 = socket$igmp6(0xa, 0x3, 0x2) getsockopt(r3, 0xff, 0x24, 0x0, &(0x7f0000000000)=0x49) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000008c0), 0x4) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x200002f, 0x0, 0x0, 0x0, 0x0, 0x375, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) syz_emit_ethernet(0x3e, 0x0, &(0x7f00000001c0)={0x1, 0x93, [0xb33, 0x9aa, 0x80000000, 0xc0f]}) 5.823834249s ago: executing program 2 (id=1661): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'essiv(authenc(rmd160-generic,cbc-camellia-aesni-avx2),sha1-avx)\x00'}, 0x58) bind$alg(r0, &(0x7f0000000700)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc-twofish-avx)\x00'}, 0x58) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) write$FUSE_NOTIFY_STORE(r1, &(0x7f00000005c0)={0x2e, 0x4, 0x0, {0x4, 0xffffffffffffffff, 0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x2e) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=@newtaction={0x2ec, 0x30, 0x400, 0x0, 0x0, {}, [{0x2d8, 0x1, [@m_xt={0x2d4, 0xc, 0x0, 0x0, {{0x7}, {0x238, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'nat\x00'}, @TCA_IPT_TARG={0xef, 0x6, {0x9, 'filter\x00', 0xfc, 0x0, "04b1e7121c5ab11af47bce12ae7266b68713ddddf1dd2208b647cc1265544887f7d0a0c0f5e633b3a761f14f84038a52069fdccdc4a94dffe0ddece2f0a0aa624f91a569e6beef188be20d91a003bb29da3739944c9e9a136230eba2088682732199c5de01f1d6c3c66381aab4817a2df0872af3dbe6b104304b573b9468513a80d6c9887175023f4f4ed5478b17736471924678eec44756a70713b6a09fc49d9bee2cd16de7325a1be721a0715ec4d68a1dc0a7215dca84b883122c3236791b22045b1667"}}, @TCA_IPT_TARG={0x11f, 0x6, {0x9, 'mangle\x00', 0x3, 0x1, "573da343a110c3ae2a4fa4391d68f56545190924efcde782a25265a335374c0cdb73588cf4d9c22db431a541ae7edc20b148c109550abfd4e161623ea3d36e29361198c0684b1917c66e9de35995cf6cb6a18571e6bdad669e5431ad32384324d6d0d2793b09f08aade22fc156200cc3218fc73438b11a2dded8d51eff7c448f4611d1d9c85d8b6cd5428623893fb433a554c4d6940f900393164326d1412e22939bc9dc38baea611f8b8fdcf1889a7596647df656c6ac353d940b92ef60f414478ffc61bf12c43bc80acab76da80a93bcf0588dd06844c2dbb6b9170948beb58a01f1c068c34e3dcbcc4e7c7ae021c235949f2d2f"}}]}, {0x77, 0x6, "8587c7552b97e1682423736310e756b91c3545392097bccb46c901f533b2ee234d4ef87d3dd8d82a6d49b8d5b8af94f31d1e36ff30622aa0c9916140265e5faf9bc2151de7e6129e6eed1a20f5cfb3fea637a7ef302d1a63c5b9f2c3d9142f7edb39254d57e79910f30512ae97c96b1c4cd96a"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x2ec}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$unix(0x1, 0x2, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, r5, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_4ADDR={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r5, 0x4, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9c9}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xe3}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x40) r7 = socket$nl_route(0x10, 0x3, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2) r8 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r9 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r9, 0x4008af60, &(0x7f0000000040)={@my=0x1}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x800007, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x2, 0x0, 0x0, 0x6}, 0x10}, 0x94) r10 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x174) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r10) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r10, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000400)={&(0x7f0000000280)={0x54, r11, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x7}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r10}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000010}, 0x10) copy_file_range(r10, 0x0, r10, &(0x7f0000000080)=0x8800000, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r10, 0xc018937c, &(0x7f0000000480)={{0x1, 0x1, 0x18, r2, {0x2}}, './bus\x00'}) write$uinput_user_dev(r12, &(0x7f0000000b00)={'syz1\x00', {0xbb, 0x1, 0x9, 0x1}, 0x1b, [0x4, 0xbbf, 0xa6fc, 0x8, 0x9, 0x10000, 0x9, 0x2, 0xd, 0xa, 0xff, 0x0, 0x5fe3, 0xb4, 0x1, 0x1, 0x3, 0x800, 0x0, 0x18, 0xfffff001, 0xfffffc1f, 0x8, 0x6, 0x7, 0x8, 0x9, 0x80, 0x2, 0x6, 0x5, 0x6, 0x0, 0x6, 0x4, 0x5c, 0x8, 0xfffffff8, 0x8, 0xc, 0x6, 0x6, 0xe9a5, 0x9, 0x4, 0x58, 0x3, 0x2, 0x800, 0x6, 0xb5, 0x1, 0x380, 0x8, 0xfffffffc, 0x7ff, 0x1, 0x80000000, 0x0, 0x74c4cafc, 0xd591, 0x80000000, 0x3, 0xc5], [0xe3b3, 0x4, 0x6, 0x3, 0x8, 0xfffffff8, 0x9, 0x8d0, 0x2, 0x9, 0x2, 0x5, 0x2, 0x6, 0x3, 0x7fff, 0x5eb, 0x9, 0x40, 0x7, 0x22f, 0xfffffffe, 0x0, 0x9, 0x5bd, 0x401, 0x0, 0x16bb, 0x3, 0x1, 0x5, 0x1ff, 0x40, 0xdc, 0x2, 0x1, 0x2, 0x8, 0x1, 0x6, 0x8c5, 0xab8, 0x400, 0x3, 0x7, 0x6, 0x6, 0x7, 0x8, 0x8000, 0x5, 0x0, 0x1000, 0x6, 0x4, 0x2, 0x5, 0x7, 0xfffffff5, 0x7, 0x8, 0x0, 0x3, 0xb], [0x8000, 0x2f, 0x4132, 0x26, 0x1000, 0x1, 0x0, 0x6, 0x7ff, 0xc6a3, 0x7, 0x3, 0xc, 0x0, 0x7, 0x6, 0x7, 0x8, 0x8000, 0x8, 0x3, 0x3, 0x7, 0x0, 0x8, 0x0, 0x5, 0x3, 0x5, 0x3ff, 0xc3, 0x9f, 0xe, 0x6e8, 0x6, 0x1000, 0x0, 0xffffff41, 0x9, 0x9, 0x3ff, 0x800, 0x7, 0x7, 0x2, 0x7, 0x7, 0x3, 0x7, 0x80, 0x3, 0x7fffffff, 0x4, 0x90, 0x5, 0x8, 0x100, 0x0, 0x7, 0x1, 0x6, 0x0, 0xb50, 0x6], [0x7, 0x1, 0x800, 0xfd, 0x7fffffff, 0x73f2, 0x4, 0x13f, 0xfffffff8, 0x5, 0x7f, 0x0, 0x5, 0x8, 0x0, 0x4, 0x32a, 0x81, 0xffff, 0x0, 0xd3e, 0x29a, 0x6, 0x7, 0x8, 0x8001, 0x3, 0x2, 0x9, 0x8, 0xac3, 0xfffffc91, 0x3, 0x6, 0x80000001, 0x8, 0x0, 0x23f7, 0x8000, 0x5, 0x9, 0x5, 0x6, 0x0, 0x8, 0x0, 0x7fffffff, 0x6, 0x5, 0x400, 0x101, 0xa, 0x4, 0x2, 0x3, 0x3, 0x9, 0x7, 0xb7, 0x5, 0x7, 0x401, 0x6, 0x5]}, 0x45c) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8b36, &(0x7f0000000000)={'wlan0\x00'}) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) 4.456118807s ago: executing program 1 (id=1662): ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) syz_usb_connect(0x6, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203011902240001000000000904290202b48cbb0009050402100000fa00090582024000000000"], 0x0) syz_usb_connect(0x6, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) socket(0x1e, 0x805, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) bind$packet(r1, &(0x7f00000001c0)={0x11, 0x15, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000), 0x8) socket$kcm(0x10, 0x3, 0x10) 4.314684038s ago: executing program 5 (id=1664): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'ip6gre0\x00', 0x0, 0x2f, 0x7, 0x80, 0x10001, 0x71, @remote, @remote, 0x7800, 0x7800, 0x4, 0xfffffffc}}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYBLOB="08000000000000007002"]) 4.077220301s ago: executing program 3 (id=1665): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000021c0)='/proc/asound/timers\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x11}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x4c, r2, 0x5, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_IE={0x18, 0x2a, [@mesh_id={0x72, 0x6}, @dsss={0x3, 0x1, 0x88}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0x0, 0xf}}]}, @NL80211_ATTR_MAC_HINT={0xa, 0xc8, @from_mac}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x44) write$FUSE_STATFS(r0, &(0x7f0000000040)={0x60, 0xfffffffffffffffe, 0x0, {{0x5, 0x7cf7, 0x7, 0x6, 0x0, 0x5, 0x8, 0x8}}}, 0x60) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r4, &(0x7f00000009c0)={0x2, 0x4e24, @empty}, 0x10) ioctl$VHOST_GET_VRING_BASE(r0, 0xc008af12, &(0x7f0000000580)) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r5, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000001600), 0x14, 0x7000000, &(0x7f0000000100)="6027a98820210172b82b22ecbdc64da99999ab9cdde9825980d5afd8654f38976e340713fac123221463a4645d8412ab50d14af845e59a9b4c322bed0473fe3a0bc3e66c8361516863336d32b39aa011976bd5ff5943c6591b983a62329cdd15a94146eeacf5082415e0199c5956eb46579021ed56a6cba6ccf60a8ec3096ef265f0ef865e5504de730fdb74d3d3e8"}) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r5, 0x0) r7 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000001000000300012800b0001006272696467650000200002800c002e000000000001000000080031"], 0x50}}, 0x0) writev(r7, &(0x7f0000000000)=[{&(0x7f0000000040)="aefdda", 0x3}], 0x1) madvise(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x15) r9 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r9, 0x80088a02, &(0x7f0000000000)) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000500)={0x0, 0xffffffffffffffff, 0x18, 0x40, @scatter={0x3, 0x0, &(0x7f0000000380)=[{&(0x7f0000000080)=""/32, 0x20}, {&(0x7f00000001c0)=""/156, 0x9c}, {&(0x7f0000000280)=""/235, 0xeb}]}, &(0x7f0000000400)="97729f55064a260524678bb775cd7aae207cbabbc878f7af", &(0x7f0000000440)=""/47, 0x7, 0x0, 0x0, &(0x7f00000004c0)}) 3.963038311s ago: executing program 5 (id=1666): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000100)={'tunl0', 0x32, 0x31}, 0x8) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000000)={[{0x81, 0x200, 0xc2, 0x4f, 0x19, 0x7, 0xc0, 0x1, 0xff, 0x6, 0xc, 0x0, 0x9}, {0xb, 0xa6f3, 0x6, 0x8, 0x9, 0xff, 0x8, 0x3, 0xa, 0x13, 0x1, 0x6, 0x10005}, {0x1fb, 0x7, 0xd, 0x10, 0x25, 0x9, 0x0, 0xfb, 0x4, 0x15, 0x1, 0x3}], 0x9}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xfffffffffffffffd, 0x0, 0x10000, 0xfffffffffffffffd, 0x4002004c4, 0x1000, 0x0, 0xfff, 0x10, 0x0, 0x3], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r3, 0xae80, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={[&(0x7f0000000000)='\x00']}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_GET_NESTED_STATE(r3, 0xc080aebe, &(0x7f00000002c0)={{0x0, 0x0, 0x80}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc018937e, &(0x7f0000000180)={{0x1, 0x1, 0x63, 0xffffffffffffffff, {0x4}}, './bus\x00'}) 3.766813396s ago: executing program 2 (id=1667): r0 = syz_io_uring_setup(0x3cb7, &(0x7f0000000640)={0x0, 0x1000addc, 0x2000, 0x0, 0x245}, &(0x7f0000000380)=0x0, &(0x7f00000003c0)=0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r3, 0x0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f00000002c0)=""/183, 0xb7}], 0x1}, 0x0, 0x80002101}) syz_open_dev$vim2m(0x0, 0x401, 0x2) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r5, 0x84, 0x23, &(0x7f0000000200)={0x0, 0x7ff}, 0x8) io_uring_enter(r0, 0xd81, 0x0, 0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r6, 0x0, 0xd}, 0x18) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='net/wireless\x00') preadv(r7, &(0x7f0000000000)=[{&(0x7f0000000400)=""/159, 0x9f}], 0x1, 0x105, 0x97e) syz_genetlink_get_family_id$batadv(&(0x7f0000000280), r4) 3.701640585s ago: executing program 5 (id=1668): ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x10001) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='contention_end\x00', r0}, 0x18) socket$packet(0x11, 0x2, 0x300) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000005640)=ANY=[@ANYBLOB="240000001400050126bc70007bdbdf2511000d000100053e3e"], 0x24}, 0x1, 0x0, 0x0, 0x8002}, 0x2005c840) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000000)="0900bf65653f47f4020000008bd458d1e7cbdaf300000f34e7e4165f081ae36850f6d15c3e681411f7a496c0da04003c242f5bedaf6bec340dee49474362b24cb800edc500", 0x0, 0x48) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) syz_open_dev$sndctrl(&(0x7f00000002c0), 0x0, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) 3.598683128s ago: executing program 1 (id=1669): socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0xe79b04dd2a128718, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000000)="0f080fae04a200400f01c426660f3a15e6160fc76bdbf08666350f2170260fed9c000066b9230b00000f32", 0x2b}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) sendmsg$nl_route(r5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) 3.490838474s ago: executing program 3 (id=1670): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x48, 0x83, 0x0, 0x80000001}, {0x6, 0x5, 0x0, 0xfffffc}]}, 0x10) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @generic={0x7, 0x6, "730342", 0x18, 0x4, 0xfe, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, {[@routing={0xc, 0x2, 0x1, 0x8, 0x40000000, [@mcast2]}]}}}}}, 0x0) 3.010949465s ago: executing program 3 (id=1671): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) preadv2(r0, &(0x7f0000000540)=[{&(0x7f0000000440)=""/201, 0xc9}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000200)=""/64, 0x40}, {&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f00000003c0)=""/55, 0x37}], 0x5, 0x28, 0x3, 0xc) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) r2 = creat(&(0x7f0000000240)='./file0/bus\x00', 0x0) acct(&(0x7f0000000100)='./file0/bus\x00') close(r2) umount2(&(0x7f0000000280)='./file0\x00', 0x0) socket$isdn(0x22, 0x2, 0x24) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r3, 0x0, 0x0) r4 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x3c, 0x1, @thr={&(0x7f0000000300)="c3c8f251aeef90390ebbf0625a00470d1dc875fe2eede3d6d5258caff851cef3c00534ab5761bf94e0321d88fb4ed5bb8d99026fb0604ca73f317e416192d08a2b49f3b96377ca3ef6585be86eb4d75a610cceeba56e0d0ebafe5068a7430e9c42c8369fa94414892c074512eb8ce65c30af0b01596d9f4ca30f51d234845072acf425b03188d4c76ae3015fbcf94180e06a1ac0f1928859332e8cca", &(0x7f0000000400)="d4c7773d5f04453f80567c1d78b4db9d3fa54e39ffffffff00000000"}}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r5, 0x25, &(0x7f0000000000)={0x1}) fcntl$lock(r5, 0x7, &(0x7f0000001140)={0x1, 0x1, 0xfe5, 0x9, r4}) socketpair$unix(0x1, 0x1, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$inet_smc(0x2b, 0x1, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r6, 0x7, &(0x7f0000000040)={0x1, 0x0, 0x76, 0x6031}) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0xfff, 0x200000, 0x5, 0x0, 0x0, 0x7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) 2.531619386s ago: executing program 2 (id=1672): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x612102, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x4, 0x0, r0, 0x8, '\x00', 0x0, r0, 0x4, 0x2}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000080), 0x1, 0x2) ioctl$VIDIOC_S_OUTPUT(r5, 0xc004562f, &(0x7f00000000c0)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000480)={0x0, @bt={0x12, 0x0, 0x0, 0x2, 0xd59f80, 0x8, 0x5, 0x7, 0x8, 0x0, 0x2, 0x596, 0x7, 0x0, 0x2e, 0xd, {0xffff945a, 0xfffffaec}, 0x3, 0xed}}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffff5}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @sk_reuseport, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 2.00505136s ago: executing program 2 (id=1673): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$TCSETA(r1, 0x5406, &(0x7f00000000c0)={0x6, 0x5, 0x3, 0x3, 0x8, "0de3ec542efcd5ee"}) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000080)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x80000000, 0x25dfdbfb, {0xa, 0x80, 0x80}, [@RTA_DST={0x8, 0x19, @local}]}, 0x24}}, 0x20000050) 1.743061597s ago: executing program 2 (id=1674): unshare(0x400) syz_clone(0x4724c000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, 0x0, 0x24000800) gettid() r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r1}, 0x10) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000200)={0x6, @local, 0x0, 0x0, 'nq\x00', 0x10, 0x5, 0x11}, 0x2c) r3 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x141042, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000200)=0x12) ioctl$SNDCTL_DSP_GETOPTR(r3, 0x800c5012, &(0x7f0000000000)) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'wlc\x00', 0x3a, 0x3, 0x8}, 0x2c) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-avx2\x00'}, 0x58) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000100)=0xc) 1.692634287s ago: executing program 3 (id=1675): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000400)=[@in6={0xa, 0x0, 0x0, @mcast1}], 0x1c) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000140)}, {&(0x7f0000000c40)="6dd950135126d19aaf46a60e", 0xc}], 0x2}, 0x0) syz_open_dev$MSR(&(0x7f0000000080), 0x5, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000002c0)={r4, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x304}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000001580)={r4, @in={{0x2, 0x0, @empty}}}, &(0x7f0000000540)=0x9c) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000140)={r6}, &(0x7f0000000180)=0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x1a}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={r4, 0x8}, 0x8) 1.607936693s ago: executing program 5 (id=1676): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) close(r2) syz_open_procfs(0x0, &(0x7f0000000580)='smaps_rollup\x00') madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000cf6000/0x4000)=nil, 0x4000, 0x16) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00000001c0)="390000fa461ad7e48489bffa56020013001118680907071200000f0000ff3f21000000170a00170000000004001400100003000131d7b2d0370a00f302415af0083f52b3ac322264dd2429f5160fe70b54eec0864a", 0x55}], 0x1) r3 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40000) setreuid(0x0, 0xee00) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f00000000c0)=ANY=[@ANYRES64=r3]) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001ec0)=ANY=[@ANYBLOB="020100030a0000000000000000000000020010000000000200000000000000000300050000000000020000009d1414000000000000000000030006000000000002"], 0x50}}, 0x0) r5 = shmget(0x3, 0x3000, 0x1, &(0x7f0000cac000/0x3000)=nil) shmat(r5, &(0x7f0000c46000/0x2000)=nil, 0x5000) lseek(r1, 0x6, 0x2) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x14, &(0x7f00000003c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}}, @printk={@llu, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x0, 0xe, 0x0, &(0x7f0000000900)="928e04b416cac951c35f7f4586e6", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = socket(0x2a, 0x2, 0x0) getsockname$packet(r8, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001000)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newtfilter={0x48, 0x2c, 0x605, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r9, {0xfff2, 0xffe0}, {}, {0x5, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @local}]}}]}, 0x48}}, 0x20004084) r10 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r10, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x20008800}, 0x20058040) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a0b0400000000000000000200000344000480240001800b000100736f636b6574000014000280080002400000000308000140000000011c0001800a00010071756575650000000c00028008000440000000000900010073797a30000000000900020073797a32"], 0x98}}, 0x0) 1.578520181s ago: executing program 3 (id=1677): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000001480)=ANY=[@ANYRES64=r0, @ANYRES8=r0, @ANYRESHEX=r0, @ANYRES8=r0], 0x24}, 0x1, 0x0, 0x0, 0x888bd8bc93c5b462}, 0x0) ioprio_set$pid(0x2, 0x0, 0x4007) r1 = epoll_create1(0x0) timerfd_settime(0xffffffffffffffff, 0x2, &(0x7f00000004c0)={{0x77359400}, {0x0, 0x989680}}, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000), 0x181801, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r3, 0x0, 0x0) sendmsg$inet_sctp(r2, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e23, @local}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x40040c4}, 0x81) r4 = dup(r2) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e21, @local}}, 0x97, 0x4001}, 0x90) ioctl$TCXONC(r4, 0x540a, 0x2) poll(&(0x7f0000000200)=[{0xffffffffffffffff, 0x8289}], 0x1, 0xdc) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000040)={0x9}) timerfd_settime(0xffffffffffffffff, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xc, &(0x7f0000000140)=0x7ff, 0x4) r5 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) sendfile(r5, r5, 0x0, 0x7) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x8401) ioctl$USBDEVFS_FREE_STREAMS(r6, 0x8008551d, 0xfffffffffffffffd) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000001900010000004000000000001c"], 0x1c}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f00000000c0), 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x3, &(0x7f00000014c0)=""/4096, &(0x7f0000001440)=0x1000) 1.258949209s ago: executing program 0 (id=1678): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)) r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_THP_DISABLE(0x29, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='hugetlbfs\x00', 0xa08000, 0x0) chdir(&(0x7f00000001c0)='./file0\x00') r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x22528, 0x800}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa}]}, 0x40}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x48940, 0x0) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='pvfs2\x00', 0x200000, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00'}, 0x94) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0x2, 0x0, 0x7, 0xb, 0x651, 0xfffffffffffffff9, 0x8000009657, 0x1, 0x7fffffff, 0x0, 0x10, 0xb, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x0, 0x0, 0x809, 0x0, 0xfffffffffffffffa, 0x3, 0x2000000000004}) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x46, &(0x7f0000000040)=0x2, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000015000103000000000000e7ff0b00000008000100", @ANYRES32=r4], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x40000) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0a000000010000003f0000000900", @ANYRES32], 0x50) 1.089339042s ago: executing program 5 (id=1679): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r3, 0x0, 0x48f, &(0x7f0000000000)={0x2c, @remote, 0x4e20, 0x0, 'none\x00', 0x32, 0x5, 0x3f}, 0x2c) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xa43, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_GET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000000914e73f"], 0x30}, 0x1, 0x0, 0x0, 0xbe9b70533f0d9e1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815001000ff05143a13600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f877501000100683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a9295cbcd8bee", 0xd8}], 0x1}, 0x0) recvfrom(r4, 0x0, 0x0, 0x20, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001380)={&(0x7f0000001440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x26, 0x26, 0x4, [@datasec={0x2, 0x1, 0x0, 0xf, 0x1, [{}], 'D'}, @datasec={0x0, 0x0, 0x0, 0xf, 0x1, [], "84"}]}, {0x0, [0x0, 0x5f]}}, &(0x7f00000014c0)=""/2, 0x44, 0x2, 0x1}, 0x28) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x28, r7, 0x301, 0x70bd2c, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0xd0}, 0x20008000) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'veth0_to_bond\x00', 0x400}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20042, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1, 0x82) pwritev2(r8, &(0x7f0000000140)=[{&(0x7f0000000000)='_', 0x1}], 0x1, 0x81, 0x0, 0x82) r9 = openat$comedi(0xffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x0, 0x0) fcntl$setstatus(r9, 0x4, 0x42400) 915.248ms ago: executing program 1 (id=1680): r0 = ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000080)={0xffffffffffffffff, 0x1, 0x0, 0x4000}) syz_open_dev$sndpcmp(0x0, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x7c737f3f81975d36, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x400000bcb) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000003c0)={0x1, @sliced={0x3, [0x7ffd, 0x8, 0x0, 0x3ff, 0x2, 0x0, 0x6, 0x4, 0x5, 0x2, 0x2, 0x0, 0xa, 0x0, 0x3, 0xc70, 0x7fff, 0x9, 0x8000, 0x3, 0x1ff, 0x4, 0x7fd, 0x9, 0x1ff, 0x9, 0xfc, 0xfff9, 0x3, 0x4a62, 0x800, 0x7, 0x400, 0xfff, 0x9, 0x5ca, 0x1, 0xc, 0x2, 0x1000, 0xc2b3, 0x1, 0x8, 0x200, 0x8, 0x7655, 0xd32b, 0x8], 0x7}}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x11, 0x65, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e23, @loopback}]}, 0x0) mbind(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, &(0x7f0000000100)=0x3ff, 0x80b, 0x6) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, &(0x7f0000000040)=0x5, 0x6, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000300)={r7, 0x8001, 0x8, 0xf801, 0x247, 0x0, 0x78f8, 0x3, {r6, @in={{0x2, 0x4e22, @multicast2}}, 0xfffffffe, 0x81, 0x6, 0x8, 0xa2f3}}, &(0x7f00000003c0)=0xb0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000940)=@o_path={&(0x7f00000002c0)='./file0\x00', r8, 0x4000, r0}, 0x18) r9 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x181001, 0x0) ioctl$COMEDI_INSNLIST(r9, 0x8010640b, &(0x7f0000000000)={0xb51952eda683b16d, &(0x7f0000104d40)=[{0x8000000, 0x0, 0x0, 0xffffffff, 0x100004}, {0x8000001, 0x0, 0x0, 0xb, 0xffff}]}) r10 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchown(r10, 0xffffffffffffffff, 0x0) 900.221239ms ago: executing program 0 (id=1681): r0 = syz_clone(0x40000000, &(0x7f0000000480)="fb97e8e0c01ab063489881d36ea03c92ef7fd3e3d7d09d69bb7687e0206cb5ab0b29fb6458b9c89565ef90263acc444ea56168dbc1793cb78db5e81aba40c78de88525b2d67b5e8bb4e9cbf21e1db90e081f7103008b88abeedd68949918f011fda43a99c9f6c5a2340bab95b204e7bfcf781582fe8e2fe64716cf94321ed029b1d6e657f9d524aa094939d7237af6495927020fb9912d91f51e232b9379a6a2b865a667c583e177258e5c6d1f630cd51201a30fa68d99cc05a30dee3deed050f4ff920615ec5f165c5913b8b6ca4781a3baeb05ec4ecf73dbe2546ddf042fec8a9c3731ff47aad879726a3ae74c4f7f8af0583a4475f7f577f538a73d5307d275e590802bc95e1e9f3420f3872252fde79ab5b2626cfef3bbab284bb7c4d0637f513821782c4fa2b34dfbe50cd6b8a5d8854039e78a020692938f2943faa9c4bcf2a334663954bde2f07078625756ed7a77b543002ed736bbad1624312f5453a008c534fa4a329b01503933bd56d9d1d219a12954a798c9ad6bbd836a2033f7f6948c00cc1a3a06e3b39e7355a3913485b4e694d314a2e3cf62e72fae79861016ec5f799458f8134061aa1adb7dcc04bea4ae3db1c034e6ff7d1061d6b5c5d5a0abeb57100c7475ad68a23d642182179646a924c1f8e00fbac96d95cd71e287c17d2a8fdb0c1f88344923b3b9336fa32d2bbd0983446741897741b69e22d40369fc182fda7d1811964fcd881cc0b7525fe4c9d0c27a582a356193798642c798ce23b04b5392cf80f59f60ed5ecf6075b6a5c3002e09b366f0579fadc0e42f5055ec73fc746e2cd582ec0c4a60c99432339f21c3f820db4e608937005c4ae951846257765eb0921fce3d8184c56ec144d274ec9d0597b4ed12893059a07201e5facd7df9e21d3dfdb93e91f84fae6ed9595f6f4e7a09d1c8bccbcd58b31d3079baab66bc10329f56cc9b54054d68878f3088ef5f051c04e6f0a8f54433cb8fc9a8f83d7733766369f2ab12c366bd74954eb52ee9e640f3bc8b7cfdd55b344b33ee7d9ea2f9e5a3ea58f4a0910fc4bb3caec48ce320089d15a75874b72d60d52809d392828d64bc8cd0e5e56019aaf8e6050d0bbfbd74491eb4a33d0a76ed10ac51f2eadebd2191b483481a4944cec46b52b9289c9a2306ab62490d40f18dbceb11eed7c347d9e22dd95b9187fa1064ba40ad26b7726b64a3cabb934a9d679b0a17c3204c8c563f7a83807cbe22af47d1eb3915b9e25ca44dcbf789394895d141950b9664c95439673b0d6f3d305818da6b3a076584e424cf914967d5f3f9732bccfc93d587cfc7b4b92c442fb0090aaaf16fee67ebe8695a04e3c08634a1bb2898f6bce9aa37b805372adcb39a0c9c61e34922921fcb4011d4af2e7de39ab56b29dab6fb032146d76f2aef5278ed68d1e7d51272b69bc9724c3f234f0a96d5d1280d3e213c191bdd7652725034f96494ccb8114343c24bbb0ae047bb15df809892f0641ccb31e9f78657e0a12cf805a6f3fa16abd79e304b7df1dde7bb265585e87c4904a8b9ac3af486fdc6736131ea16cff75a07af1a6ba51a112fa9ce14cdb659dd01348a7dfaf39743b00a55bafbefe094e2c6e58175db16f90301ea4715f49b85684bb2dd99ed2be5e708a80a88e6580bc46e7dba2abedabb2f2160a86dc6de377cd3b0baa6bb9e93c89e872ba6cbedbf8bf6621d273df02ca1799a5b8e0c48e54d177e073798866785f4f6e58e9c8493c1805e24ca8f68847d269bf1972e604305af5cc9fa5066a87e2b52730eca99293004d5e903a33c83a36fa867237c4e9223a556f2950ea04570b791260559176d433d41000c866c96a51bc3c30c8d0a2f44baa72b3d671ca3ad798a74ce4ec0da4a5cbfee7473832c3cd6772cf324929d0f917a8888401e82edac766204497460690d46cf5392693e2b26498a3bbda85285bfc33cea508a7b2bd9a1b519dac2189a757ea9319e30a2ba9d1a010bedd9bf5103579905bdf5603ed2c5559acf1d371f8c525d40e3fa6cd675c5931c76bd1c529d50aa93855062b540861ae91bed96a9e8375484614fe831303992436aeb394ce236dca0a7baae4f51c16b46c72102c7a9bcccd32f21bfb01ac6377b9933e95d16bac660d8fea5b4d53e755cd136c5c8ead42c5b43b83b9b779f7e3f0b5d6eb0ffcc89a22fe76c33ad7a5258926bb57e0b0eb1f679ce267a1272babffb1601177af5473737631f30b2b824a756af9c4f10fbb800ed969a87472ef59da904bcde6ba3965d9f63d6a4293f4814c9360454ab5aedd4c8636d8d8481488b1287959d83292345a605ba73258add56f3cfec95470a7f46cb9845910a593a480a3fdee4cc5e752f897fd2ceb2a2c1f506048596ef33a317f79bdd1b64284a3e171821e0d9388c52c7e1c0df38a6afaaeb6e172302b8bb50ae977f0b845454d142f9eeca346532471ba4fff386ea358123ffce003163abb8b7a1beb03a99d75fe24d8a4e798756b9ff1409c859254f1dd4a4f757dad0e5853b932ec7157eac3b3b08b29979a47ae7fad780da23a246492dcbe865131df4c7935c88e6ce08085fa177b8cdfc1346497ce0541b70f80157448ed781769fc0d69fbbe046cba44f53079ab44cacd9f509669614c5dabb3dbf36d235c0b355a6399a2206464c9062c5625b59aaaa9df0fc750dd4251fab86a1a27fcad3de8335aab23cabd537e9976a602313a73d7248e7636f45bf1b7e288909e48a3ba3bad3e8b3b5bba945df96e687a313171178bce3357a898992c72c94b278822e26a88b1fbc050de628c2e16d523df3d6e73ea20cda29c259ad396e2e945b946349dd97d078bd5e9d0e88f5225be350d158cb6968ae17df90758f33a77c196c16a0d7c739b36bea7e8ded42c6dbf0f795a785646ad59d486e4d3068c828d1b29bd1cd28db37e308b014b5e6b1356718ca9bf0be9b8142acdaa8394fd081a33f6289c8e6756b3b916ee2a8749a8a2debed3c3cff98d54470b68541002189cd629e20d83539c1a2318b6558fb491ca583358d3cf8d6200655b4c09fe8f53117da65b85b9469ca9c87e798d96a81b8a39745c925bb6d0ed26c5d8e5c90ee1afd7223a2f672367dfdf78ded101cd18ec5c2f6de3918724c8959e5e88ef3601c8cf8bf71ff4d8547a3070e0bda523e1c481605574aee3124767932710619d53c3fd33be167846ea420bacdb3e881786e733f61c2be0c204f4b8c113fd07efc26e17a4005fce260048c3344b8c0ce4bbf9efa454e2d298e1b744b23253c972e35f314f94d63d5120255a8cdc3a102aac1179ce6000315448036d68f9a493709b00367492e47a8753d3ff2e6738099311d0bf1b9e9df81e6897404ea9431c6483f8184c6be21c23a2b040b8535317d3b2a3c67db439ac02f11417c542eaba22814050b965381048b33a9ed23bcc8fe8a6de9e5d678fea5114a1eb8f8e09930ae108f250ee58afc5b28ef183801deaf9889ce491efd98ffd9cc91c3d1492bd053a4c386764b8572b29552cfa6754b5355bb7636a35d61fbc2931cc826b9917cf5bee61cf4898df4a06ecf4cb01b09717af84fe711ad2a4fe8ddeadfd64bdb718a5df8aee21b96a7bfd60bf4d1f0d6b605a03af88bb8c2df18da8e16c60be45480c341cc20edda4ce693285a74e607aaea6b29cafb38ef6fb03cc5af560631d09605567ae5c398d48e01dfd3e518906b92ec00d5c01497af578d1cd06776a627164a89229290b019355174f291d8d7f8a13837162c4c238c98d8747359b59df9a50ddcd739a96b76f71319f2900a145cd78f2cd0a686111d85cedf83955d0b99802dac4c6e9f5e73104ddb8d9aa05433badbfb7d614ae522d1a098a59d7902ff3966eb6d6af633d2c07bfe1d28294475edf927f913b3435b93b9eb078f455e40846d96dbeffef2cbc65f1b03600024133499562ce51a44fa0373da2dda0cacf78b776a7389072060cce5d578cde768adff4f20ee8d1b3309f34930f1dd60e436d39298fa698b054727bbe19c21a05e2370c9da47246adc0c715c0c5acc7b00dce62a3f64ac63bd5e14d0f692623e88a93e0a45b73da3d0b924d98df113b5968c92746640dabcf7f8b4e3c161882744f2e6b445cf71bfba3f35a99d9718ce6f052d944c31638f21358eee804136fab748bbbda9c2d83cbfaff72ee9a98cda411e0cdbf776feed2f875ac5c0c5f615f73cb68c1f65364e2045fd8451c622cc669c733c60c23c820d204ed5ab1edbcff63e2975cdc7b005b763e302f8524cd4cb6d89f204be4c95b7cf8e3ca70fc35844e8ad6e526c54eea40315e51713e4f930d223c4be64126f169f23f28b132eb8bc44805ac189712206f92c5ea9a6c1f8b7bb52c3d59639128ee69e4618d66728b339f24ac83b57cb86c8da43830856b21d53e257e5ced1b15f7c7a41a9bd76d5ec7ad436115012d6b2a53cffafcdde3eb0130636b927d3d34b908f2fcd5fe2e96b9c2ccd6cf2f99c9c0fd242f9876c6d7cc5b6288165bd4c0ca0d35d04117e1f785a71565f486953ffd272539dd74867cb4e4e12378e8670104db1d701cec21c45d40b0db0b78b969d86147796283b9d3d0d8740aeb1f6e76856967177e39ef9c408d4aa538c0e5f0ea5f8c34805d378c99c4b054d06711c7cae76fdf4885d6131a3fcb6c3ab455db23d9d6ec03d6ccff1c5165abac10bb362b450f072b1b4382debae1f4220aff792e740bb98298c30b8f5aa6cc82b80a5f4c7752a7cd1d0066da4b579bce9497d6e21a0894da81cc56838a78826b73a49974d27f547e4097ac652ec3884cbe815ac62ef556e84c922cd77f23faa9b5733367f8b11787cb446ecaf632725464307dd3fd9bf21aabfc6203f2ec4c7d67effe4c3cab4df1a28ca91ec8e9070a5d099597efde0b8d08c7efb5f84b0ba0bab26b214a269e50015d111095893ca7532562935273fc8158459a9d848724e8b74828e526ad6d81e4f809024c2cc0f2070b1269dff34098fb10efff29d20dbb71c30959d9478057f008bc18559f4c8254331cc73dd60a681629f7f3e7ff42dc19974e50d035d33b652630ba85135bff1102cf85f39a2b7957e1bd5a1280fe27ea3bc17e1bdebd973f8836ee16b783478313708d7ca6d7dc8a69b73f797b938097e014dfd5d4798110061ae16a6f9f57aa6de4dac323f092bde394de916ab9c963bffb5cf557b699d3c85674dd2b3c81cbd5e2d63de34b73a756c023e7339bd5f58d1ed7b85f29588d373001289f7001ea204c8be074ebd35cd451e7344745f41572f16d4bfa79d2fa679f9cf959501cde15eccee135136c43fc5e5184011ba9d497de7b865f49eaafff0f5d5a5b564482810916195635d458ccc45464d4331cd6c7d52f9fb044587ae2a687048fc68450b1b0207f131504de6cbd90f9791824e96547e7d4bdf2e699ea8738a4c30abb85837fbf98499866f54907193e800e6b6d879838ed0b185558f4223a94b7c9cf0deb2620fa406f1adecc120bae7b97fa695ade67ed4bff6db29d83f70ae5a647d67313fea6b1e8405e0f226c57061bb012d08929d9da5f0bd640c25fc0959cb4c8dcee7f58beda5f5cef57b11ba9adf48c1b226a28e5a068740e311b7b8302307dcc7f28e05d39ab24d3caba79bafaf3a683952f0b44e33c6b093980aacc8404757049206292e2b675173f0eb0e4030590018de57ff8cceea0a2b75483f6557fda426bdc078869f5e711f2f249a6c8be2470cd45c15747e86101db8d3d6bde90266c5fb50d9b4d4d206aa89ed210307146cbd2fa470d732651ff8d431a3", 0x1000, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)="b5a5bf89a5bd") timer_create(0x0, &(0x7f0000000000)={0x0, 0x3e, 0x0, @tid=r0}, &(0x7f0000000300)=0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x38, r3, 0xc79c59394d69f4e3, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x400c010) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) pipe2$watch_queue(0x0, 0x80) 307.089698ms ago: executing program 2 (id=1682): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000340)=ANY=[@ANYBLOB="0b000000000000008404"]) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r4, 0x5761, &(0x7f0000000840)=ANY=[@ANYBLOB="06"]) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r4, 0x0) add_key$keyring(&(0x7f0000000300), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, r3) r5 = add_key$fscrypt_v1(&(0x7f00000001c0), &(0x7f0000000200)={'fscrypt:', @desc4}, &(0x7f00000002c0)={0x0, "a7c927b54a642a9a4d67e67c060407ee32e7f8e311fe41d6abd45d392772f41bbcb47150ed2bd499551f0076dfb6530c8844cb5fe8082800419f185877a930c7", 0x21}, 0x48, 0xffffffffffffffff) keyctl$instantiate(0xc, r3, &(0x7f0000000040)=@encrypted_update={'update ', 'default', 0x20, 'trusted:', ':[)*^{$*&'}, 0x21, r5) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f0000000fc0)={0x1, 0x7, {0x200, @struct={0x1000, 0x5}, 0x0, 0x6, 0x9, 0x4, 0x280000000, 0x6, 0x1b, @struct={0x8, 0x8}, 0x7, 0x800, [0x1, 0x2, 0x6, 0xf0, 0x7, 0x1]}, {0x0, @struct={0x597f, 0xffffff88}, 0x0, 0x6, 0x400, 0x8, 0x3, 0x8, 0x4, @struct={0x80000000, 0xfa42}, 0x6, 0xfffffc00, [0x7fffffff, 0x3, 0x44, 0x9, 0x4, 0x9]}, {0x6, @struct={0x21efa886, 0x8}, 0x0, 0x0, 0x787, 0x0, 0x5, 0x1ff, 0xc1, @struct={0x1, 0xfff}, 0xd337, 0x4, [0x7f, 0x3, 0x7fffffffffffffff, 0x1, 0x6, 0x1]}, {0x6, 0x8, 0x3}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f00000013c0)={r7, 0x1, 0x9, 0x1}) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000400)={r6, 0x3, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r8, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) r9 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r10 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) syz_emit_ethernet(0x3e, &(0x7f0000000280)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd60f4adf700082c00fe800000000000000000000000000000ffe5"], 0x0) ioctl$KVM_GET_MSRS(r9, 0xc008ae88, &(0x7f0000000240)) 306.325732ms ago: executing program 3 (id=1683): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$smackfs_ipv6host(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$smackfs_ipv6host(r3, &(0x7f00000003c0)=@l2={{0x34a1, 0x3a, 0x7, 0x3a, 0x800, 0x3a, 0x8, 0x3a, 0x7ff, 0x3a, 0x100, 0x3a, 0x2af3bf97, 0x3a, 0xffffffffffffffef}, 0x2f, 0x1, 0x20, '/dev/nullb0\x00'}, 0xba) 0s ago: executing program 5 (id=1684): mq_open(&(0x7f0000000040)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!T\xeeux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x4, 0x2000400, 0x3f00}) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0xbf, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb1, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x7, @loopback, @rand_addr=0x640100fe, {[@cipso={0x86, 0x77, 0x0, [{0x0, 0xc, "e256b28c590300000052"}, {0x0, 0x9, "020007651442eb"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, "e706d30bd224f8"}, {0x2, 0x7, "cfa11cab1a"}, {0x0, 0x10, "8475be675de6a70a05a0dc91e5c6"}, {0x0, 0xa, "0000000000800000"}, {0x0, 0x12, "73bc23f9ffffffa30900a301c8460000"}, {0x0, 0x12, "c8f46976e79ea788f03d9d3205927e3d"}]}, @cipso={0x86, 0x6, 0x20}]}}, "fd"}}}}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x70bd29, 0x0, {0x2, 0x20, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@RTA_PREFSRC={0x8, 0x7, @private=0xa010102}]}, 0x24}}, 0x0) r2 = fsmount(0xffffffffffffffff, 0x0, 0x8) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000100)={'wg0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@ipv4_newaddr={0x5c, 0x14, 0x8, 0x70bd2d, 0x25dfdbfb, {0x2, 0x78, 0x17, 0x0, r3}, [@IFA_ADDRESS={0x8, 0x1, @multicast2}, @IFA_RT_PRIORITY={0x8, 0x9, 0x1}, @IFA_TARGET_NETNSID={0x8, 0xa, 0x1}, @IFA_TARGET_NETNSID={0x8}, @IFA_CACHEINFO={0x14, 0x6, {0x4, 0x0, 0xc8e, 0x1000}}, @IFA_LOCAL={0x8, 0x2, @multicast1}, @IFA_TARGET_NETNSID={0x8, 0xa, 0xffff}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x20048000) close_range(r1, r2, 0x0) kernel console output (not intermixed with test programs): ys_sendmsg+0x19b/0x260 [ 411.441082][ T9793] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 411.441098][ T9793] ? __pfx_ksys_write+0x10/0x10 [ 411.441114][ T9793] ? do_syscall_64+0xbe/0x3b0 [ 411.441126][ T9793] do_syscall_64+0xfa/0x3b0 [ 411.441135][ T9793] ? lockdep_hardirqs_on+0x9c/0x150 [ 411.441149][ T9793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.441159][ T9793] ? clear_bhb_loop+0x60/0xb0 [ 411.441171][ T9793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.441180][ T9793] RIP: 0033:0x7fc3fd98e929 [ 411.441191][ T9793] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 411.441199][ T9793] RSP: 002b:00007fc3fe73b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 411.441210][ T9793] RAX: ffffffffffffffda RBX: 00007fc3fdbb6080 RCX: 00007fc3fd98e929 [ 411.441217][ T9793] RDX: 0000000020000000 RSI: 0000200000000040 RDI: 0000000000000008 [ 411.441224][ T9793] RBP: 00007fc3fe73b090 R08: 0000000000000000 R09: 0000000000000000 [ 411.441230][ T9793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 411.441236][ T9793] R13: 0000000000000000 R14: 00007fc3fdbb6080 R15: 00007ffd2005fd68 [ 411.441251][ T9793] [ 413.799651][ T9811] binder: 9810:9811 ioctl c0306201 0 returned -14 [ 414.070848][ T5158] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 414.794194][ T9754] delete_channel: no stack [ 417.348365][ T9843] netlink: 4 bytes leftover after parsing attributes in process `syz.1.955'. [ 417.360115][ T9843] hsr_slave_0: left promiscuous mode [ 417.397632][ T9843] hsr_slave_1: left promiscuous mode [ 417.447024][ T9847] fuse: Bad value for 'fd' [ 418.543277][ T9855] Trying to write to read-only block-device nullb0 [ 420.131911][ T9880] bridge_slave_0: default FDB implementation only supports local addresses [ 421.940936][ T24] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 423.110909][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 423.171049][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 423.235999][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 423.292141][ T24] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 423.335238][ T5158] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 423.464994][ T24] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 423.539300][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.622492][ T24] usb 4-1: Product: syz [ 423.639486][ T24] usb 4-1: Manufacturer: syz [ 423.664566][ T24] usb 4-1: SerialNumber: syz [ 423.684883][ T9903] netlink: 4 bytes leftover after parsing attributes in process `syz.0.974'. [ 426.215516][ T24] usb 4-1: 0:2 : does not exist [ 426.225613][ T9879] delete_channel: no stack [ 426.301673][ T24] usb 4-1: USB disconnect, device number 22 [ 426.376646][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 426.420805][ T5841] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 426.624893][ T5841] usb 1-1: config 0 has an invalid interface number: 122 but max is 0 [ 426.638187][ T5841] usb 1-1: config 0 has no interface number 0 [ 426.680721][ T5841] usb 1-1: config 0 interface 122 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 426.713770][ T5841] usb 1-1: New USB device found, idVendor=0f11, idProduct=1020, bcdDevice=90.16 [ 426.726905][ T5841] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.860632][ T5841] usb 1-1: Product: syz [ 426.874419][ T5841] usb 1-1: Manufacturer: syz [ 426.882638][ T5841] usb 1-1: SerialNumber: syz [ 426.897964][ T5841] usb 1-1: config 0 descriptor?? [ 426.904094][ T9919] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 426.918750][ T5841] ldusb 1-1:0.122: Interrupt in endpoint not found [ 427.512464][ T9919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.553254][ T9919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.580467][ T9944] overlayfs: failed to resolve './file0': -2 [ 427.590050][ T9919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.628013][ T9919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.712294][ T9919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.785135][ T9919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.122194][ T43] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 428.384989][ T5957] usb 1-1: USB disconnect, device number 15 [ 428.440807][ T43] usb 6-1: Using ep0 maxpacket: 16 [ 428.466114][ T43] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.508904][ T43] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 428.549165][ T43] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 428.787099][ T43] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 428.796650][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.804730][ T43] usb 6-1: Product: syz [ 428.817153][ T9953] fuse: Bad value for 'user_id' [ 428.823221][ T9953] fuse: Bad value for 'user_id' [ 428.837010][ T43] usb 6-1: Manufacturer: syz [ 428.841762][ T43] usb 6-1: SerialNumber: syz [ 430.801185][ T9] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 430.993197][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 431.007236][ T9] usb 2-1: too many configurations: 140, using maximum allowed: 8 [ 431.038329][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 431.085563][ T9] usb 2-1: can't read configurations, error -61 [ 432.036913][ T9] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 432.101199][ T43] usb 6-1: 0:2 : does not exist [ 432.201652][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 432.339649][ T9986] Bluetooth: hci0: load_link_keys: too big key_count value 2816 [ 432.361700][ T43] usb 6-1: USB disconnect, device number 17 [ 432.712479][ T9] usb 2-1: too many configurations: 140, using maximum allowed: 8 [ 433.209183][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 433.240913][ T9] usb 2-1: can't read configurations, error -61 [ 433.256281][ T9] usb usb2-port1: attempt power cycle [ 433.260107][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 433.630852][ T9] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 433.688339][ T9992] netlink: 32 bytes leftover after parsing attributes in process `syz.0.998'. [ 433.860686][ T9] usb 2-1: device not accepting address 16, error -71 [ 434.670388][ T9957] delete_channel: no stack [ 435.680814][ T9] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 435.772187][T10013] nfs: Unknown parameter '' [ 436.510797][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 436.527472][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 436.539771][ T9] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 436.550522][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.578872][ T9] usb 6-1: config 0 descriptor?? [ 436.955337][ T43] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 437.170830][ T43] usb 4-1: Using ep0 maxpacket: 16 [ 438.312739][ T43] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 438.326504][ T43] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 438.340640][ T43] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 438.372810][ T43] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 438.385754][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.572676][ T43] usb 4-1: Product: syz [ 438.577092][ T43] usb 4-1: Manufacturer: syz [ 438.582643][ T43] usb 4-1: SerialNumber: syz [ 438.638177][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 439.762657][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 439.796003][ T9] usb 6-1: USB disconnect, device number 18 [ 440.231775][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.239962][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.120476][T10041] delete_channel: no stack [ 441.724940][ T43] usb 4-1: 0:2 : does not exist [ 441.866777][ T43] usb 4-1: USB disconnect, device number 23 [ 442.068938][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 445.271653][ T24] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 445.821178][T10093] delete_channel: no stack [ 445.832081][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 445.857221][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 445.887712][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 445.900705][ T24] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 445.927857][ T24] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 445.938641][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.946816][ T24] usb 4-1: Product: syz [ 445.951376][ T24] usb 4-1: Manufacturer: syz [ 445.956733][ T24] usb 4-1: SerialNumber: syz [ 445.990947][T10101] input: syz0 as /devices/virtual/input/input21 [ 446.085521][T10101] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1027'. [ 446.136361][T10101] netlink: 'syz.5.1027': attribute type 2 has an invalid length. [ 446.148335][T10101] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1027'. [ 449.391806][ T24] usb 4-1: 0:2 : does not exist [ 449.489089][ T24] usb 4-1: USB disconnect, device number 24 [ 450.740715][ T24] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 450.920927][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 450.949712][ T24] usb 4-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 450.987094][ T24] usb 4-1: config 0 has an invalid interface descriptor of length 2, skipping [ 451.010636][ T24] usb 4-1: config 0 has an invalid descriptor of length 127, skipping remainder of the config [ 451.051633][ T24] usb 4-1: config 0 has no interfaces? [ 451.125749][ T24] usb 4-1: New USB device found, idVendor=0572, idProduct=6831, bcdDevice= f.71 [ 451.228975][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.344695][ T24] usb 4-1: Product: syz [ 451.349310][ T24] usb 4-1: Manufacturer: syz [ 451.402010][ T24] usb 4-1: SerialNumber: syz [ 451.544687][ T24] usb 4-1: config 0 descriptor?? [ 452.273820][ T24] usb 4-1: USB disconnect, device number 25 [ 453.580957][ T5927] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 453.728071][T10161] delete_channel: no stack [ 453.890840][ T5927] usb 1-1: Using ep0 maxpacket: 16 [ 453.902170][ T5927] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 453.944003][ T5927] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 453.973581][ T5927] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 454.058198][ T5927] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 454.087368][ T5927] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.120741][ T5927] usb 1-1: Product: syz [ 454.131830][ T5927] usb 1-1: Manufacturer: syz [ 454.136486][ T5927] usb 1-1: SerialNumber: syz [ 456.632422][ T5927] usb 1-1: 0:2 : does not exist [ 456.721725][ T5927] usb 1-1: USB disconnect, device number 16 [ 457.743210][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 459.302027][T10220] delete_channel: no stack [ 460.407256][ T5927] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 460.469620][ T5927] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 460.524376][ T24] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 460.750801][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 460.770129][ T24] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 461.210671][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 461.219704][ T24] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 461.277711][T10244] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 461.336669][ T24] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 461.356492][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.376132][ T24] usb 1-1: Product: syz [ 461.396876][T10244] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 461.411598][ T24] usb 1-1: Manufacturer: syz [ 461.420726][ T24] usb 1-1: SerialNumber: syz [ 461.796880][T10248] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 462.942420][T10259] lo speed is unknown, defaulting to 1000 [ 464.098922][ T24] usb 1-1: 0:2 : does not exist [ 464.200959][ T24] usb 1-1: USB disconnect, device number 17 [ 464.266136][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 464.809273][T10277] FAULT_INJECTION: forcing a failure. [ 464.809273][T10277] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 464.823286][T10277] CPU: 0 UID: 0 PID: 10277 Comm: syz.1.1071 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 464.823312][T10277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 464.823322][T10277] Call Trace: [ 464.823330][T10277] [ 464.823337][T10277] dump_stack_lvl+0x189/0x250 [ 464.823355][T10277] ? __pfx____ratelimit+0x10/0x10 [ 464.823377][T10277] ? __pfx_dump_stack_lvl+0x10/0x10 [ 464.823391][T10277] ? __pfx__printk+0x10/0x10 [ 464.823403][T10277] ? __might_fault+0xb0/0x130 [ 464.823423][T10277] should_fail_ex+0x414/0x560 [ 464.823440][T10277] _copy_from_user+0x2d/0xb0 [ 464.823453][T10277] ___sys_sendmsg+0x158/0x2a0 [ 464.823467][T10277] ? __pfx____sys_sendmsg+0x10/0x10 [ 464.823501][T10277] ? __x64_sys_sendmsg+0x180/0x260 [ 464.823515][T10277] __x64_sys_sendmsg+0x19b/0x260 [ 464.823528][T10277] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 464.823603][T10277] ? __pfx_ksys_write+0x10/0x10 [ 464.823619][T10277] ? do_syscall_64+0xbe/0x3b0 [ 464.823631][T10277] do_syscall_64+0xfa/0x3b0 [ 464.823641][T10277] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.823651][T10277] ? asm_sysvec_call_function_single+0x1a/0x20 [ 464.823660][T10277] ? clear_bhb_loop+0x60/0xb0 [ 464.823671][T10277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.823681][T10277] RIP: 0033:0x7fc3fd98e929 [ 464.823692][T10277] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 464.823700][T10277] RSP: 002b:00007fc3fe71a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 464.823713][T10277] RAX: ffffffffffffffda RBX: 00007fc3fdbb6160 RCX: 00007fc3fd98e929 [ 464.823719][T10277] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000009 [ 464.823725][T10277] RBP: 00007fc3fe71a090 R08: 0000000000000000 R09: 0000000000000000 [ 464.823731][T10277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 464.823738][T10277] R13: 0000000000000000 R14: 00007fc3fdbb6160 R15: 00007ffd2005fd68 [ 464.823753][T10277] [ 466.154211][T10289] delete_channel: no stack [ 467.532612][T10307] FAULT_INJECTION: forcing a failure. [ 467.532612][T10307] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 467.548639][T10307] CPU: 0 UID: 0 PID: 10307 Comm: syz.1.1077 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 467.548663][T10307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 467.548673][T10307] Call Trace: [ 467.548682][T10307] [ 467.548689][T10307] dump_stack_lvl+0x189/0x250 [ 467.548714][T10307] ? __pfx____ratelimit+0x10/0x10 [ 467.548737][T10307] ? __pfx_dump_stack_lvl+0x10/0x10 [ 467.548756][T10307] ? __pfx__printk+0x10/0x10 [ 467.548777][T10307] ? __might_fault+0xb0/0x130 [ 467.548809][T10307] should_fail_ex+0x414/0x560 [ 467.548836][T10307] _copy_from_user+0x2d/0xb0 [ 467.548855][T10307] do_ipv6_setsockopt+0x32d/0x2fb0 [ 467.548875][T10307] ? look_up_lock_class+0x74/0x170 [ 467.548906][T10307] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 467.548927][T10307] ? __lock_acquire+0xab9/0xd20 [ 467.548950][T10307] ? __mutex_trylock_common+0x153/0x260 [ 467.548971][T10307] ? __pfx___mutex_trylock_common+0x10/0x10 [ 467.548992][T10307] ? rcu_is_watching+0x15/0xb0 [ 467.549009][T10307] ? trace_contention_end+0x39/0x120 [ 467.549029][T10307] ? __mutex_lock+0x330/0xe80 [ 467.549042][T10307] ? get_pid_task+0x20/0x1f0 [ 467.549072][T10307] ? smc_setsockopt+0x181/0xab0 [ 467.549097][T10307] ? __pfx___mutex_lock+0x10/0x10 [ 467.549111][T10307] ? rcu_read_lock_any_held+0xb3/0x120 [ 467.549131][T10307] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 467.549152][T10307] ? vfs_write+0x8d8/0xa90 [ 467.549180][T10307] ipv6_setsockopt+0x59/0x170 [ 467.549201][T10307] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 467.549219][T10307] smc_setsockopt+0x232/0xab0 [ 467.549247][T10307] ? __pfx_smc_setsockopt+0x10/0x10 [ 467.549274][T10307] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 467.549295][T10307] ? __pfx_smc_setsockopt+0x10/0x10 [ 467.549318][T10307] do_sock_setsockopt+0x25a/0x3e0 [ 467.549351][T10307] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 467.549376][T10307] ? __fget_files+0x2a/0x420 [ 467.549400][T10307] __x64_sys_setsockopt+0x18b/0x220 [ 467.549427][T10307] do_syscall_64+0xfa/0x3b0 [ 467.549442][T10307] ? lockdep_hardirqs_on+0x9c/0x150 [ 467.549464][T10307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.549481][T10307] ? clear_bhb_loop+0x60/0xb0 [ 467.549501][T10307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.549515][T10307] RIP: 0033:0x7fc3fd98e929 [ 467.549530][T10307] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 467.549542][T10307] RSP: 002b:00007fc3fe73b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 467.549561][T10307] RAX: ffffffffffffffda RBX: 00007fc3fdbb6080 RCX: 00007fc3fd98e929 [ 467.549572][T10307] RDX: 0000000000000003 RSI: 0000000000000029 RDI: 0000000000000007 [ 467.549580][T10307] RBP: 00007fc3fe73b090 R08: 0000000000000108 R09: 0000000000000000 [ 467.549590][T10307] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000001 [ 467.549600][T10307] R13: 0000000000000000 R14: 00007fc3fdbb6080 R15: 00007ffd2005fd68 [ 467.549626][T10307] [ 468.791041][ T5927] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 468.990912][ T5927] usb 6-1: Using ep0 maxpacket: 16 [ 469.120678][ T5927] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 469.140859][ T5927] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 469.159066][ T5927] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 469.199802][ T5927] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 469.209175][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.254418][ T5927] usb 6-1: Product: syz [ 469.258657][ T5927] usb 6-1: Manufacturer: syz [ 469.269118][ T5927] usb 6-1: SerialNumber: syz [ 470.329525][ T5158] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 471.456257][T10348] delete_channel: no stack [ 471.788387][ T5927] usb 6-1: 0:2 : does not exist [ 471.938299][ T5927] usb 6-1: USB disconnect, device number 19 [ 472.158376][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 472.458205][T10367] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1090'. [ 475.235477][T10367] team0 (unregistering): Port device team_slave_0 removed [ 475.389351][T10367] team0 (unregistering): Port device team_slave_1 removed [ 475.712238][T10417] delete_channel: no stack [ 476.001480][T10428] can0: slcan on ttyS3. [ 476.562948][T10428] can0 (unregistered): slcan off ttyS3. [ 478.742625][T10434] __vm_enough_memory: pid: 10434, comm: syz.5.1110, bytes: 21199876923392 not enough memory for the allocation [ 479.071805][T10445] syzkaller1: entered promiscuous mode [ 479.077482][T10445] syzkaller1: entered allmulticast mode [ 480.603184][T10451] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1114'. [ 480.613167][T10451] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1114'. [ 481.795429][T10458] bridge_slave_0: left allmulticast mode [ 481.814102][T10458] bridge_slave_0: left promiscuous mode [ 481.955772][T10458] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.020841][ T5841] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 482.539152][T10468] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1117'. [ 482.565327][T10458] bridge_slave_1: left allmulticast mode [ 482.583706][T10458] bridge_slave_1: left promiscuous mode [ 482.592027][T10458] bridge0: port 2(bridge_slave_1) entered disabled state [ 482.612041][T10458] bond0: (slave bond_slave_0): Releasing backup interface [ 482.626526][T10458] bond0: (slave bond_slave_1): Releasing backup interface [ 482.637515][T10458] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 482.649675][T10458] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 482.659493][T10458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 482.668597][T10458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 482.720729][ T5841] usb 6-1: Using ep0 maxpacket: 16 [ 483.113763][ T5957] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 483.145752][ T5841] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 483.159071][ T5841] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 483.172533][T10464] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 483.179974][T10464] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 483.213621][ T5841] usb 6-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76 [ 483.246861][ T5841] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.256179][ T5841] usb 6-1: Product: syz [ 483.266252][ T5841] usb 6-1: Manufacturer: syz [ 483.273500][ T5957] usb 2-1: device descriptor read/64, error -71 [ 483.280098][ T5841] usb 6-1: SerialNumber: syz [ 483.357565][ T5841] usb 6-1: config 0 descriptor?? [ 483.378585][ T10] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 483.871143][ T5957] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 484.199928][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 484.247381][ T5841] usb_8dev 6-1:0.0 can0: sending command message failed [ 484.320804][ T5957] usb 2-1: device descriptor read/64, error -71 [ 484.500034][ T10] usb 1-1: not running at top speed; connect to a high speed hub [ 484.510234][ T5957] usb usb2-port1: attempt power cycle [ 485.213348][ T10] usb 1-1: config 219 has 1 interface, different from the descriptor's value: 2 [ 485.226473][ T5841] usb_8dev 6-1:0.0 can0: can't get firmware version [ 485.234580][ T10] usb 1-1: config 219 interface 0 has no altsetting 0 [ 485.243246][ T10] usb 1-1: config 219 interface 0 has no altsetting 1 [ 485.267679][ T10] usb 1-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 485.338672][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.351382][T10480] netlink: 'syz.3.1122': attribute type 24 has an invalid length. [ 485.372483][ T10] usb 1-1: Product: syz [ 485.378907][ T10] usb 1-1: Manufacturer: syz [ 485.390620][ T10] usb 1-1: SerialNumber: syz [ 485.760323][ T5841] usb_8dev 6-1:0.0: probe with driver usb_8dev failed with error -22 [ 485.788366][ T5841] usb 6-1: USB disconnect, device number 20 [ 486.765640][ T10] usb 1-1: can't set config #219, error -71 [ 486.787299][ T10] usb 1-1: USB disconnect, device number 18 [ 486.870913][ T5957] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 487.786932][ T5957] usb 2-1: device descriptor read/8, error -71 [ 488.346378][ T5957] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 489.337501][ T5957] usb 2-1: device descriptor read/8, error -71 [ 489.475999][ T5957] usb usb2-port1: unable to enumerate USB device [ 490.099873][T10523] pim6reg: entered allmulticast mode [ 491.022909][T10533] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1134'. [ 491.806611][ T5158] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 493.068673][T10553] netlink: 'syz.0.1142': attribute type 21 has an invalid length. [ 494.954953][T10566] delete_channel: no stack [ 496.398312][ T5158] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 496.433859][T10325] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 497.110796][T10325] usb 1-1: Using ep0 maxpacket: 16 [ 497.134347][T10325] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 497.160979][T10325] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 497.196530][T10325] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 497.213792][T10325] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 497.224422][T10325] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.234670][T10325] usb 1-1: Product: syz [ 497.238981][T10325] usb 1-1: Manufacturer: syz [ 497.245174][T10325] usb 1-1: SerialNumber: syz [ 497.318507][T10573] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1149'. [ 497.775627][T10604] usb usb8: usbfs: process 10604 (syz.1.1159) did not claim interface 0 before use [ 498.551081][T10611] netlink: 'syz.1.1160': attribute type 21 has an invalid length. [ 498.867873][ T5158] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 499.604261][T10325] usb 1-1: 0:2 : does not exist [ 499.745940][T10626] fuse: Bad value for 'user_id' [ 499.751263][T10626] fuse: Bad value for 'user_id' [ 500.172643][T10325] usb 1-1: USB disconnect, device number 19 [ 500.174029][T10627] tipc: Enabling of bearer rejected, failed to enable media [ 500.248892][T10628] bridge0: entered promiscuous mode [ 500.256511][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 500.327611][T10628] bond0: entered promiscuous mode [ 500.380962][T10628] bond_slave_0: entered promiscuous mode [ 500.474709][T10628] bond_slave_1: entered promiscuous mode [ 500.580817][T10325] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 500.860374][T10628] hsr1: entered allmulticast mode [ 500.866037][T10628] bridge0: entered allmulticast mode [ 500.891046][T10628] bond0: entered allmulticast mode [ 500.909421][T10640] netlink: 'syz.1.1170': attribute type 21 has an invalid length. [ 500.917686][T10628] bond_slave_0: entered allmulticast mode [ 500.938569][T10628] bond_slave_1: entered allmulticast mode [ 500.952332][T10325] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 500.988153][T10325] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 501.021422][T10325] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 501.035742][T10325] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.069105][T10325] usb 1-1: config 0 descriptor?? [ 501.385802][T10650] Bluetooth: hci0: load_link_keys: too big key_count value 2816 [ 501.775424][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.781800][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.848175][T10652] netlink: 'syz.5.1174': attribute type 21 has an invalid length. [ 503.208425][T10325] uclogic 0003:256C:006D.000B: failed retrieving Huion firmware version: -71 [ 503.255249][T10325] uclogic 0003:256C:006D.000B: failed probing parameters: -71 [ 503.327384][T10325] uclogic 0003:256C:006D.000B: probe with driver uclogic failed with error -71 [ 503.558176][T10325] usb 1-1: USB disconnect, device number 20 [ 503.609544][T10669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1180'. [ 503.989149][T10679] FAULT_INJECTION: forcing a failure. [ 503.989149][T10679] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 504.003336][T10679] CPU: 1 UID: 0 PID: 10679 Comm: syz.5.1183 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 504.003361][T10679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 504.003373][T10679] Call Trace: [ 504.003381][T10679] [ 504.003390][T10679] dump_stack_lvl+0x189/0x250 [ 504.003416][T10679] ? __pfx____ratelimit+0x10/0x10 [ 504.003441][T10679] ? __pfx_dump_stack_lvl+0x10/0x10 [ 504.003461][T10679] ? __pfx__printk+0x10/0x10 [ 504.003483][T10679] ? __might_fault+0xb0/0x130 [ 504.003520][T10679] should_fail_ex+0x414/0x560 [ 504.003550][T10679] _copy_from_user+0x2d/0xb0 [ 504.003571][T10679] memdup_user+0x5e/0xd0 [ 504.003591][T10679] strndup_user+0x68/0xd0 [ 504.003610][T10679] keyctl_pkey_params_get+0xd5/0x450 [ 504.003640][T10679] ? __pfx_keyctl_pkey_params_get+0x10/0x10 [ 504.003661][T10679] ? lockdep_hardirqs_on+0x9c/0x150 [ 504.003703][T10679] ? rcu_is_watching+0x15/0xb0 [ 504.003723][T10679] ? trace_sched_exit_tp+0x38/0x120 [ 504.003747][T10679] ? __schedule+0x16c0/0x4cb0 [ 504.003782][T10679] keyctl_pkey_query+0xbf/0x260 [ 504.003806][T10679] ? __pfx_keyctl_pkey_query+0x10/0x10 [ 504.003836][T10679] ? __pfx___schedule+0x10/0x10 [ 504.003866][T10679] __se_sys_keyctl+0x7d4/0x910 [ 504.003885][T10679] ? __pfx___se_sys_keyctl+0x10/0x10 [ 504.003903][T10679] ? rcu_is_watching+0x15/0xb0 [ 504.003921][T10679] ? trace_irq_disable+0x37/0x110 [ 504.003944][T10679] ? preempt_schedule_irq+0xde/0x150 [ 504.003966][T10679] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 504.003995][T10679] ? irqentry_exit+0x74/0x90 [ 504.004018][T10679] ? lockdep_hardirqs_on+0x9c/0x150 [ 504.004056][T10679] ? __x64_sys_keyctl+0x20/0xc0 [ 504.004074][T10679] do_syscall_64+0xfa/0x3b0 [ 504.004092][T10679] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.004108][T10679] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 504.004124][T10679] ? clear_bhb_loop+0x60/0xb0 [ 504.004145][T10679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.004161][T10679] RIP: 0033:0x7fb478f8e929 [ 504.004179][T10679] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 504.004193][T10679] RSP: 002b:00007fb479d14038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 504.004214][T10679] RAX: ffffffffffffffda RBX: 00007fb4791b6160 RCX: 00007fb478f8e929 [ 504.004226][T10679] RDX: 0000000000000000 RSI: 0000000017bcc963 RDI: 0000000000000018 [ 504.004238][T10679] RBP: 00007fb479d14090 R08: 0000000000000000 R09: 0000000000000000 [ 504.004248][T10679] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000001 [ 504.004260][T10679] R13: 0000000000000000 R14: 00007fb4791b6160 R15: 00007ffd99633738 [ 504.004289][T10679] [ 504.007632][T10679] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 504.972201][T10685] fuse: Unknown parameter '00000000000000000000' [ 505.969003][ T5957] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 506.749085][T10718] FAULT_INJECTION: forcing a failure. [ 506.749085][T10718] name failslab, interval 1, probability 0, space 0, times 0 [ 506.768384][T10718] CPU: 0 UID: 0 PID: 10718 Comm: syz.5.1195 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 506.768410][T10718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 506.768420][T10718] Call Trace: [ 506.768425][T10718] [ 506.768430][T10718] dump_stack_lvl+0x189/0x250 [ 506.768447][T10718] ? __pfx____ratelimit+0x10/0x10 [ 506.768462][T10718] ? __pfx_dump_stack_lvl+0x10/0x10 [ 506.768473][T10718] ? __pfx__printk+0x10/0x10 [ 506.768488][T10718] ? __pfx___might_resched+0x10/0x10 [ 506.768501][T10718] should_fail_ex+0x414/0x560 [ 506.768519][T10718] should_failslab+0xa8/0x100 [ 506.768534][T10718] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 506.768549][T10718] ? __alloc_skb+0x112/0x2d0 [ 506.768562][T10718] __alloc_skb+0x112/0x2d0 [ 506.768575][T10718] netlink_sendmsg+0x5c6/0xb30 [ 506.768587][T10718] ? tomoyo_socket_sendmsg_permission+0x160/0x300 [ 506.768602][T10718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 506.768620][T10718] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 506.768633][T10718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 506.768644][T10718] __sock_sendmsg+0x219/0x270 [ 506.768661][T10718] ____sys_sendmsg+0x505/0x830 [ 506.768676][T10718] ? __pfx_____sys_sendmsg+0x10/0x10 [ 506.768692][T10718] ? import_iovec+0x74/0xa0 [ 506.768705][T10718] ___sys_sendmsg+0x21f/0x2a0 [ 506.768718][T10718] ? __pfx____sys_sendmsg+0x10/0x10 [ 506.768728][T10718] ? irqentry_exit+0x74/0x90 [ 506.768761][T10718] ? __fget_files+0x2a/0x420 [ 506.768769][T10718] ? __fget_files+0x3a0/0x420 [ 506.768783][T10718] __x64_sys_sendmsg+0x19b/0x260 [ 506.768796][T10718] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 506.768812][T10718] ? __pfx_ksys_write+0x10/0x10 [ 506.768828][T10718] ? do_syscall_64+0xbe/0x3b0 [ 506.768839][T10718] do_syscall_64+0xfa/0x3b0 [ 506.768849][T10718] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.768858][T10718] ? asm_sysvec_call_function_single+0x1a/0x20 [ 506.768867][T10718] ? clear_bhb_loop+0x60/0xb0 [ 506.768878][T10718] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.768888][T10718] RIP: 0033:0x7fb478f8e929 [ 506.768898][T10718] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 506.768906][T10718] RSP: 002b:00007fb479d35038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 506.768918][T10718] RAX: ffffffffffffffda RBX: 00007fb4791b6080 RCX: 00007fb478f8e929 [ 506.768925][T10718] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000005 [ 506.768931][T10718] RBP: 00007fb479d35090 R08: 0000000000000000 R09: 0000000000000000 [ 506.768937][T10718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 506.768942][T10718] R13: 0000000000000000 R14: 00007fb4791b6080 R15: 00007ffd99633738 [ 506.768957][T10718] [ 507.093031][ T5957] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 507.103822][ T5957] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 507.113433][ T5845] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 507.129968][ T5957] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 507.139189][ T5957] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.147894][ T5957] usb 3-1: Product: syz [ 507.152612][ T5957] usb 3-1: Manufacturer: syz [ 507.157293][ T5957] usb 3-1: SerialNumber: syz [ 507.378659][T10722] Bluetooth: hci0: load_link_keys: too big key_count value 2816 [ 507.424067][ T5845] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 507.511200][ T5845] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 507.690443][ T5845] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 507.703121][ T5845] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 507.725462][ T5957] usb 3-1: cannot find UAC_HEADER [ 507.740686][T10703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.762044][ T5845] usb 1-1: Manufacturer: syz [ 507.801783][ T5845] usb 1-1: config 0 descriptor?? [ 507.803955][T10703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.849110][ T5845] igorplugusb 1-1:0.0: endpoint incorrect [ 507.858816][ T5957] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 507.873499][T10727] fuse: Unknown parameter 'rootmo0000060000r_id' [ 507.915325][ T5927] usb 3-1: USB disconnect, device number 17 [ 508.052911][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 508.086342][T10714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.145047][T10714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.178779][T10734] fuse: Unknown parameter '00000000000000000000' [ 509.888971][ T5927] usb 1-1: USB disconnect, device number 21 [ 509.991555][T10748] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1205'. [ 511.761065][ T5845] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 512.231086][ T5845] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 512.353662][T10764] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1209'. [ 512.390941][ T5845] usb 2-1: New USB device found, idVendor=0853, idProduct=0146, bcdDevice= 0.00 [ 512.433712][ T5845] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.466026][ T5845] usb 2-1: config 0 descriptor?? [ 512.512856][ T5845] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 512.645413][T10776] netlink: 25 bytes leftover after parsing attributes in process `syz.3.1211'. [ 513.095309][T10781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.140947][T10781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 513.947185][T10788] autofs: Bad value for 'fd' [ 514.475381][ T5957] usb 2-1: USB disconnect, device number 22 [ 514.687911][T10795] netlink: 244 bytes leftover after parsing attributes in process `syz.5.1215'. [ 517.419621][T10814] fuse: Bad value for 'user_id' [ 517.424842][T10814] fuse: Bad value for 'user_id' [ 518.912426][T10829] overlayfs: failed to resolve './file0': -2 [ 519.290655][ T5957] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 519.884902][ T5957] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 519.895296][ T5957] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 519.913734][ T5957] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 520.453265][ T5957] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 520.462867][ T5957] usb 6-1: SerialNumber: syz [ 520.805835][ T5957] usb 6-1: 0:2 : does not exist [ 520.896258][T10845] autofs: Unknown parameter '0x0000000000000000' [ 521.428293][ T5957] usb 6-1: USB disconnect, device number 21 [ 521.610089][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 523.320120][T10874] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 523.343519][T10874] netlink: 'syz.0.1235': attribute type 16 has an invalid length. [ 523.352616][T10874] netlink: 'syz.0.1235': attribute type 3 has an invalid length. [ 523.360876][T10874] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1235'. [ 524.080798][ T5957] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 524.410813][ T5957] usb 3-1: device descriptor read/64, error -71 [ 524.652655][ T9] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 524.720829][ T9] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 524.734168][ T5957] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 524.977732][T10891] autofs: Unknown parameter '0x0000000000000000' [ 525.601420][ T5957] usb 3-1: device descriptor read/64, error -71 [ 525.812323][ T5957] usb usb3-port1: attempt power cycle [ 526.875004][T10900] usb usb8: usbfs: process 10900 (syz.1.1245) did not claim interface 0 before use [ 527.226816][ T5957] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 527.569500][T10906] nft_compat: unsupported protocol 1 [ 527.734158][ T5957] usb 3-1: device not accepting address 20, error -71 [ 528.408830][T10914] syz.1.1249: attempt to access beyond end of device [ 528.408830][T10914] loop1: rw=0, sector=16, nr_sectors = 2 limit=0 [ 529.301951][T10934] xt_l2tp: invalid flags combination: 8 [ 530.068893][T10941] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1253'. [ 530.415534][T10941] netlink: 'syz.3.1253': attribute type 5 has an invalid length. [ 530.484733][T10941] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1253'. [ 530.549743][T10941] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 530.560202][T10941] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 530.569466][T10941] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 530.580299][T10941] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 530.629988][T10941] geneve2: entered promiscuous mode [ 530.645268][T10941] geneve2: entered allmulticast mode [ 531.815008][T10961] nft_compat: unsupported protocol 1 [ 532.177849][ T5957] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 532.245885][ T5957] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 532.557140][T10967] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 532.876634][T10969] input: syz1 as /devices/virtual/input/input23 [ 532.887920][T10969] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1265'. [ 535.019832][T10998] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1274'. [ 535.029383][T10998] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1274'. [ 535.041664][T10998] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1274'. [ 535.054064][T10998] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1274'. [ 535.264894][ T5900] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 535.523526][ T5900] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 535.538637][ T5900] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 535.549015][ T5900] usb 3-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 535.631803][ T5927] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 536.138834][ T5900] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.184626][ T5900] usb 3-1: config 0 descriptor?? [ 536.340767][ T5927] usb 1-1: Using ep0 maxpacket: 32 [ 536.442777][ T5927] usb 1-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=88.ea [ 536.464666][T10990] trusted_key: syz.2.1270 sent an empty control message without MSG_MORE. [ 536.474944][ T5927] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.605238][ T5927] usb 1-1: Product: syz [ 536.621929][ T5927] usb 1-1: Manufacturer: syz [ 536.626828][ T5927] usb 1-1: SerialNumber: syz [ 536.722052][T11029] Device name cannot be null; rc = [-22] [ 537.364188][T11030] fuse: Bad value for 'user_id' [ 537.369908][T11030] fuse: Bad value for 'user_id' [ 537.682606][ T5927] usb 1-1: config 0 descriptor?? [ 537.742649][ T5927] ati_remote 1-1:0.0: ati_remote_probe: Unexpected desc.bNumEndpoints [ 537.916643][T11006] xt_socket: unknown flags 0x8 [ 538.009133][T11039] netlink: 'syz.1.1282': attribute type 21 has an invalid length. [ 538.085049][ T5957] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 538.094506][ T5957] hid-generic 0000:0000:0000.000E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 538.989998][ T5841] usb 1-1: USB disconnect, device number 22 [ 539.187206][ T5957] usb 3-1: USB disconnect, device number 22 [ 539.231685][T11051] lo: entered promiscuous mode [ 539.257178][T11051] tunl0: entered promiscuous mode [ 539.275353][T11051] gre0: entered promiscuous mode [ 539.287953][T11051] gretap0: entered promiscuous mode [ 539.315925][T11051] erspan0: entered promiscuous mode [ 539.330458][T11055] netlink: 'syz.2.1287': attribute type 21 has an invalid length. [ 539.569816][T11051] ip_vti0: entered promiscuous mode [ 539.912762][T11051] ip6_vti0: entered promiscuous mode [ 540.112297][T11051] sit0: entered promiscuous mode [ 540.194915][T11051] ip6tnl0: entered promiscuous mode [ 540.285299][T11051] ip6gre0: entered promiscuous mode [ 540.366531][T11051] syz_tun: entered promiscuous mode [ 540.392676][T11051] ip6gretap0: entered promiscuous mode [ 540.420119][T11051] bridge0: entered promiscuous mode [ 540.446771][T11051] vcan0: entered promiscuous mode [ 540.493981][T11051] bond0: entered promiscuous mode [ 540.499041][T11051] bond_slave_0: entered promiscuous mode [ 540.559817][T11051] bond_slave_1: entered promiscuous mode [ 540.622087][T11051] team0: entered promiscuous mode [ 540.632442][T11051] team_slave_0: entered promiscuous mode [ 540.665300][T11051] team_slave_1: entered promiscuous mode [ 540.679422][T11051] dummy0: entered promiscuous mode [ 540.697633][T11051] nlmon0: entered promiscuous mode [ 540.715697][T11051] caif0: entered promiscuous mode [ 540.722889][T11051] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 540.793057][ T24] lo speed is unknown, defaulting to 1000 [ 541.550082][T11075] netlink: 'syz.0.1294': attribute type 21 has an invalid length. [ 541.890694][ T5927] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 541.935669][T11090] block device autoloading is deprecated and will be removed. [ 542.125801][ T5927] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 542.155659][ T9] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 542.200794][ T24] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 542.371639][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 542.453550][ T9] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 542.530449][ T9] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 542.634284][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 542.743424][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 542.775788][ T5927] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 542.791805][ T5927] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 542.802283][ T5927] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 542.810385][ T5927] usb 6-1: SerialNumber: syz [ 542.810758][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 542.854878][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 542.940314][ T24] usb 1-1: config 3 has an invalid interface number: 216 but max is 0 [ 542.950772][ T9] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 542.960780][ T24] usb 1-1: config 3 has no interface number 0 [ 542.967057][ T24] usb 1-1: config 3 interface 216 altsetting 7 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 542.982668][ T24] usb 1-1: config 3 interface 216 has no altsetting 0 [ 543.003631][ T24] usb 1-1: New USB device found, idVendor=2c24, idProduct=ab13, bcdDevice=ac.4a [ 543.013776][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.021886][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.021915][ T24] usb 1-1: Product: syz [ 543.021929][ T24] usb 1-1: Manufacturer: syz [ 543.021943][ T24] usb 1-1: SerialNumber: syz [ 543.029948][T11096] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 543.075408][ T5927] usb 6-1: 0:2 : does not exist [ 543.100866][ T5927] usb 6-1: unit 5: unexpected type 0x03 [ 543.129021][ T9] usb 2-1: config 0 descriptor?? [ 543.165372][ T5927] usb 6-1: USB disconnect, device number 22 [ 543.212096][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 543.401934][ T9] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 23 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 543.475126][ T9] usb 2-1: USB disconnect, device number 23 [ 543.562471][T11104] program syz.2.1307 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 543.991387][ T9] usblp0: removed [ 545.331253][ T9] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 545.456813][ T24] usb 1-1: bad CDC descriptors [ 545.465698][T11113] netlink: 'syz.5.1309': attribute type 21 has an invalid length. [ 545.511780][ T24] usb 1-1: USB disconnect, device number 23 [ 545.713685][ T5927] libceph: connect (1)[c::]:6789 error -22 [ 545.730121][ T5927] libceph: mon0 (1)[c::]:6789 connect error [ 545.761931][T11125] ceph: No mds server is up or the cluster is laggy [ 546.027299][T11138] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1316'. [ 546.791014][ T5927] usb 6-1: new full-speed USB device number 23 using dummy_hcd [ 547.003677][ T5927] usb 6-1: not running at top speed; connect to a high speed hub [ 547.022565][ T5927] usb 6-1: config 95 has an invalid interface number: 86 but max is 0 [ 547.040569][ T5927] usb 6-1: config 95 has no interface number 0 [ 547.047389][ T5927] usb 6-1: config 95 interface 86 altsetting 8 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 547.159593][ T5927] usb 6-1: config 95 interface 86 has no altsetting 0 [ 547.178808][ T5927] usb 6-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=88.93 [ 547.209971][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.228537][ T5927] usb 6-1: Product: syz [ 547.238694][ T5927] usb 6-1: Manufacturer: syz [ 547.269504][ T5927] usb 6-1: SerialNumber: syz [ 547.494445][T11149] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 547.525636][ T30] audit: type=1326 audit(1752752404.892:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb478f8e929 code=0x7ffc0000 [ 547.526530][T11136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.574668][T11136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.791538][T11160] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 547.862870][T11161] FAULT_INJECTION: forcing a failure. [ 547.862870][T11161] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 547.877133][T11161] CPU: 0 UID: 0 PID: 11161 Comm: syz.3.1321 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 547.877158][T11161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 547.877170][T11161] Call Trace: [ 547.877178][T11161] [ 547.877186][T11161] dump_stack_lvl+0x189/0x250 [ 547.877210][T11161] ? __pfx____ratelimit+0x10/0x10 [ 547.877245][T11161] ? __pfx_dump_stack_lvl+0x10/0x10 [ 547.877265][T11161] ? __pfx__printk+0x10/0x10 [ 547.877299][T11161] should_fail_ex+0x414/0x560 [ 547.877329][T11161] _copy_from_user+0x2d/0xb0 [ 547.877350][T11161] input_ff_effect_from_user+0x7f/0x220 [ 547.877379][T11161] evdev_ioctl_handler+0xa5f/0x1f10 [ 547.877406][T11161] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 547.877430][T11161] ? __pfx_evdev_ioctl_handler+0x10/0x10 [ 547.877452][T11161] ? __pfx_smack_log+0x10/0x10 [ 547.877473][T11161] ? smk_access+0x14c/0x4e0 [ 547.877497][T11161] ? smk_tskacc+0x2fc/0x370 [ 547.877523][T11161] ? smack_file_ioctl+0x24a/0x340 [ 547.877547][T11161] ? __pfx_smack_file_ioctl+0x10/0x10 [ 547.877584][T11161] ? __fget_files+0x2a/0x420 [ 547.877605][T11161] ? bpf_lsm_file_ioctl+0x9/0x20 [ 547.877622][T11161] ? __pfx_evdev_ioctl+0x10/0x10 [ 547.877643][T11161] __se_sys_ioctl+0xfc/0x170 [ 547.877667][T11161] do_syscall_64+0xfa/0x3b0 [ 547.877685][T11161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.877702][T11161] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 547.877718][T11161] ? clear_bhb_loop+0x60/0xb0 [ 547.877739][T11161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.877755][T11161] RIP: 0033:0x7f6f0298e929 [ 547.877772][T11161] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 547.877786][T11161] RSP: 002b:00007f6f03870038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 547.877805][T11161] RAX: ffffffffffffffda RBX: 00007f6f02bb6160 RCX: 00007f6f0298e929 [ 547.877818][T11161] RDX: 0000000000000000 RSI: 0000000040304580 RDI: 0000000000000009 [ 547.877829][T11161] RBP: 00007f6f03870090 R08: 0000000000000000 R09: 0000000000000000 [ 547.877839][T11161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 547.877850][T11161] R13: 0000000000000000 R14: 00007f6f02bb6160 R15: 00007ffd58e74308 [ 547.877880][T11161] [ 548.191380][ T24] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 548.199159][ T30] audit: type=1326 audit(1752752404.892:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb478f8e929 code=0x7ffc0000 [ 548.222627][ T30] audit: type=1326 audit(1752752404.892:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb478f8d290 code=0x7ffc0000 [ 548.225776][T11136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.282941][T11136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.362955][ T30] audit: type=1326 audit(1752752404.892:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb478f8e52b code=0x7ffc0000 [ 548.363031][ T30] audit: type=1326 audit(1752752404.892:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb478f8e52b code=0x7ffc0000 [ 548.363071][ T30] audit: type=1326 audit(1752752405.152:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb478f8e929 code=0x7ffc0000 [ 548.363111][ T30] audit: type=1326 audit(1752752405.152:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb478f8e929 code=0x7ffc0000 [ 548.363171][ T30] audit: type=1326 audit(1752752405.562:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7fb478f8e929 code=0x7ffc0000 [ 548.363210][ T30] audit: type=1326 audit(1752752405.592:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb478f8e929 code=0x7ffc0000 [ 548.363253][ T30] audit: type=1326 audit(1752752405.592:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11135 comm="syz.5.1315" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb478f8e929 code=0x7ffc0000 [ 548.375901][T11136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.376861][T11136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.414771][ T5927] iguanair 6-1:95.86: probe with driver iguanair failed with error -12 [ 548.437675][ C1] vkms_vblank_simulate: vblank timer overrun [ 548.460360][ T5927] usb 6-1: USB disconnect, device number 23 [ 548.474482][ T24] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 548.474512][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.477587][ T24] usb 3-1: config 0 descriptor?? [ 548.784851][ C1] vkms_vblank_simulate: vblank timer overrun [ 548.839829][T11166] netlink: 'syz.3.1323': attribute type 21 has an invalid length. [ 548.991356][T11167] Invalid source name [ 549.158259][ T24] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 549.176009][T11167] UBIFS error (pid: 11167): cannot open "./file0", error -22 [ 551.515465][ T24] [drm:udl_init] *ERROR* Selecting channel failed [ 551.733170][T11191] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 552.035832][ T24] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 2 [ 552.067685][ T24] [drm] Initialized udl on minor 2 [ 552.124170][ T24] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 552.427941][ T24] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 552.533504][ T5927] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 552.556729][ T24] usb 3-1: USB disconnect, device number 23 [ 552.571249][ T5927] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 552.660749][T11207] netlink: 'syz.0.1335': attribute type 21 has an invalid length. [ 553.863463][T11230] netlink: 'syz.1.1340': attribute type 16 has an invalid length. [ 553.871548][T11230] netlink: 'syz.1.1340': attribute type 3 has an invalid length. [ 553.879296][T11230] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1340'. [ 554.106943][ T24] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 554.480708][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 554.559309][ T24] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 554.631041][ T24] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 554.671284][ T24] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 554.688599][ T24] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 554.704092][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.715963][ T24] usb 6-1: Product: syz [ 554.722407][ T24] usb 6-1: Manufacturer: syz [ 554.727147][ T24] usb 6-1: SerialNumber: syz [ 556.337351][T11254] netlink: 'syz.2.1347': attribute type 21 has an invalid length. [ 557.023711][ T24] usb 6-1: 0:2 : does not exist [ 557.073823][ T24] usb 6-1: USB disconnect, device number 24 [ 557.117331][T11265] FAULT_INJECTION: forcing a failure. [ 557.117331][T11265] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 557.147994][ T7181] udevd[7181]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 557.209146][T11265] CPU: 0 UID: 0 PID: 11265 Comm: syz.3.1350 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 557.209173][T11265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 557.209183][T11265] Call Trace: [ 557.209190][T11265] [ 557.209198][T11265] dump_stack_lvl+0x189/0x250 [ 557.209224][T11265] ? __pfx____ratelimit+0x10/0x10 [ 557.209248][T11265] ? __pfx_dump_stack_lvl+0x10/0x10 [ 557.209267][T11265] ? __pfx__printk+0x10/0x10 [ 557.209300][T11265] should_fail_ex+0x414/0x560 [ 557.209329][T11265] _copy_to_user+0x31/0xb0 [ 557.209350][T11265] simple_read_from_buffer+0xe1/0x170 [ 557.209379][T11265] proc_fail_nth_read+0x1df/0x250 [ 557.209400][T11265] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 557.209421][T11265] ? rw_verify_area+0x258/0x650 [ 557.209441][T11265] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 557.209460][T11265] vfs_read+0x200/0x980 [ 557.209490][T11265] ? __pfx_vfs_read+0x10/0x10 [ 557.209511][T11265] ? bpf_lsm_socket_connect+0x9/0x20 [ 557.209537][T11265] ? __sys_connect+0x339/0x440 [ 557.209558][T11265] ? __pfx___sys_connect+0x10/0x10 [ 557.209592][T11265] ksys_read+0x145/0x250 [ 557.209616][T11265] ? __pfx_ksys_read+0x10/0x10 [ 557.209642][T11265] ? do_syscall_64+0xbe/0x3b0 [ 557.209662][T11265] do_syscall_64+0xfa/0x3b0 [ 557.209677][T11265] ? lockdep_hardirqs_on+0x9c/0x150 [ 557.209700][T11265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.209717][T11265] ? clear_bhb_loop+0x60/0xb0 [ 557.209736][T11265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.209751][T11265] RIP: 0033:0x7f6f0298d33c [ 557.209768][T11265] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 557.209781][T11265] RSP: 002b:00007f6f038b2030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 557.209800][T11265] RAX: ffffffffffffffda RBX: 00007f6f02bb5fa0 RCX: 00007f6f0298d33c [ 557.209813][T11265] RDX: 000000000000000f RSI: 00007f6f038b20a0 RDI: 0000000000000005 [ 557.209824][T11265] RBP: 00007f6f038b2090 R08: 0000000000000000 R09: 0000000000000000 [ 557.209834][T11265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 557.209843][T11265] R13: 0000000000000000 R14: 00007f6f02bb5fa0 R15: 00007ffd58e74308 [ 557.209872][T11265] [ 557.747857][T11270] nft_compat: unsupported protocol 1 [ 558.087115][T11277] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 558.230653][T11277] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 559.202255][T11288] netlink: 'syz.0.1358': attribute type 21 has an invalid length. [ 559.283482][T11290] netlink: 'syz.3.1357': attribute type 21 has an invalid length. [ 560.018481][T11304] fuse: Bad value for 'user_id' [ 560.023677][T11304] fuse: Bad value for 'user_id' [ 561.002827][T11319] nft_compat: unsupported protocol 1 [ 561.368199][T11306] block nbd0: server does not support multiple connections per device. [ 561.420650][T11321] overlayfs: missing 'lowerdir' [ 561.496315][T11306] block nbd0: shutting down sockets [ 561.836498][T11332] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1368'. [ 561.989695][T11334] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1368'. [ 563.043907][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.044005][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.490721][ T5927] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 563.680646][ T5927] usb 2-1: Using ep0 maxpacket: 8 [ 563.708783][ T5927] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 563.722552][ T5927] usb 2-1: config 0 has no interface number 0 [ 563.729139][ T5927] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 563.746682][ T5927] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 563.759646][ T5927] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 563.787600][ T5927] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 563.808277][ T5927] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 563.817808][ T5927] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 563.831707][T10325] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 563.987756][ T5927] usb 2-1: config 0 descriptor?? [ 564.001171][T10325] usb 1-1: Using ep0 maxpacket: 8 [ 564.079163][T10325] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 564.219320][T10325] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 564.670628][T10325] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.711275][T10325] usb 1-1: Product: syz [ 564.716324][T10325] usb 1-1: Manufacturer: syz [ 564.724009][T11343] netlink: 'syz.3.1372': attribute type 21 has an invalid length. [ 564.744066][ T5927] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 564.789228][T10325] usb 1-1: SerialNumber: syz [ 564.862015][T11345] netlink: 'syz.3.1373': attribute type 21 has an invalid length. [ 564.866642][T10325] usb 1-1: config 0 descriptor?? [ 564.939884][T10325] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 564.949528][T10325] usb 1-1: setting power ON [ 564.965013][T10325] dvb-usb: bulk message failed: -22 (2/0) [ 565.035447][T10325] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 565.046414][T10325] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 565.057245][T10325] usb 1-1: media controller created [ 565.265093][T10325] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 565.415147][T10325] usb 1-1: selecting invalid altsetting 6 [ 565.438849][T10325] usb 1-1: digital interface selection failed (-22) [ 565.467834][T10325] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 565.486230][T10325] usb 1-1: setting power OFF [ 565.497666][T10325] dvb-usb: bulk message failed: -22 (2/0) [ 565.507317][T10325] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 565.571739][T11354] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 565.583787][T11354] netlink: 'syz.5.1376': attribute type 16 has an invalid length. [ 565.591996][T11354] netlink: 'syz.5.1376': attribute type 3 has an invalid length. [ 565.599877][T11354] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1376'. [ 566.507407][ T5841] usb 2-1: USB disconnect, device number 25 [ 566.549075][ T5841] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 566.761115][T10325] (NULL device *): no alternate interface [ 567.197998][T11361] nft_compat: unsupported protocol 1 [ 567.221247][T10325] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 567.445465][ T5927] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 567.487372][T10325] usb 1-1: USB disconnect, device number 24 [ 567.655230][ T5927] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 567.698211][ T5927] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 567.735752][ T5927] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 8256, setting to 64 [ 567.767537][ T5927] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 567.779935][ T5927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.814073][ T5927] usb 2-1: Product: syz [ 567.915948][ T5927] usb 2-1: Manufacturer: syz [ 568.048788][T11378] netlink: 'syz.2.1383': attribute type 21 has an invalid length. [ 568.057420][ T5927] usb 2-1: SerialNumber: syz [ 568.100693][T11357] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 568.241030][T11380] netlink: 'syz.2.1384': attribute type 21 has an invalid length. [ 568.881485][T11390] xt_TCPMSS: Only works on TCP SYN packets [ 569.772559][T11392] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1388'. [ 570.412554][ T5927] cdc_ncm 2-1:1.0: bind() failure [ 570.414439][T11401] loop7: detected capacity change from 0 to 7 [ 570.429990][ T5927] usb 2-1: USB disconnect, device number 26 [ 570.456321][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.465845][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.492294][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.503705][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.519137][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.528699][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.545435][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.554795][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.585623][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.594900][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.605159][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.614774][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.625151][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.635818][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.644682][T11401] ldm_validate_partition_table(): Disk read failed. [ 570.696640][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.706046][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.729247][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.739049][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.764002][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 570.774656][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 570.784502][T11401] Dev loop7: unable to read RDB block 0 [ 570.824105][T11401] loop7: unable to read partition table [ 570.871022][T11401] loop7: partition table beyond EOD, truncated [ 570.976066][T11401] loop_reread_partitions: partition scan of loop7 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 571.094543][T11414] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1393'. [ 571.630087][ T5208] ldm_validate_partition_table(): Disk read failed. [ 571.749345][ T5208] Dev loop7: unable to read RDB block 0 [ 571.777369][ T5208] loop7: unable to read partition table [ 571.816624][ T5208] loop7: partition table beyond EOD, truncated [ 571.837583][T11417] netlink: 'syz.3.1394': attribute type 21 has an invalid length. [ 574.376061][T11451] xt_TCPMSS: Only works on TCP SYN packets [ 575.448265][T11462] netlink: 'syz.2.1407': attribute type 21 has an invalid length. [ 575.652112][ T36] bond1: (slave ip6gretap1): link status up again after 0 ms [ 575.681728][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 575.780607][ T5841] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 575.821289][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 575.950827][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 575.970563][ T5841] usb 2-1: Using ep0 maxpacket: 8 [ 576.145673][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 576.381859][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 576.461179][ T5841] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 576.493482][ T5841] usb 2-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 576.512358][ T5841] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.563990][ T5841] usb 2-1: Product: syz [ 576.583091][ T5841] usb 2-1: Manufacturer: syz [ 576.598058][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 576.628434][ T5841] usb 2-1: SerialNumber: syz [ 576.668011][ T5841] usb 2-1: config 0 descriptor?? [ 576.676578][T11471] delete_channel: no stack [ 576.694671][ T5841] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 576.722824][ T5841] usb 2-1: selecting invalid altsetting 1 [ 576.733013][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 576.872619][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 576.928159][T11456] netlink: 'syz.1.1404': attribute type 9 has an invalid length. [ 577.099169][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 577.133481][T11456] macvlan2: entered promiscuous mode [ 577.155490][T11456] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 577.723140][T11498] sp0: Synchronizing with TNC [ 577.737405][ T5841] gspca_stk014: reg_r err -110 [ 577.743007][ T5841] stk014 2-1:0.0: probe with driver stk014 failed with error -110 [ 577.792263][ T5841] usb 2-1: USB disconnect, device number 27 [ 577.803077][T11498] ieee802154 phy0 wpan0: encryption failed: -22 [ 578.268175][T11505] trusted_key: encrypted_key: insufficient parameters specified [ 580.345323][T11531] netlink: 'syz.5.1423': attribute type 1 has an invalid length. [ 580.379667][T11531] netlink: 'syz.5.1423': attribute type 3 has an invalid length. [ 580.389210][T11531] netlink: 224 bytes leftover after parsing attributes in process `syz.5.1423'. [ 580.964218][ T3508] net_ratelimit: 16 callbacks suppressed [ 580.964242][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 581.223395][T11539] nft_compat: unsupported protocol 1 [ 581.313140][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 581.635009][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 581.765441][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 581.889264][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 582.285774][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 582.452921][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 583.361470][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 583.566426][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 584.495975][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 585.128915][T11586] netlink: 84 bytes leftover after parsing attributes in process `syz.5.1436'. [ 585.973452][T11593] nft_compat: unsupported protocol 1 [ 586.072365][ T36] net_ratelimit: 5 callbacks suppressed [ 586.072444][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 586.301032][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 586.410838][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 586.543000][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 586.621858][T11595] FAULT_INJECTION: forcing a failure. [ 586.621858][T11595] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 586.665149][T11595] CPU: 1 UID: 0 PID: 11595 Comm: syz.1.1440 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 586.665178][T11595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 586.665189][T11595] Call Trace: [ 586.665196][T11595] [ 586.665204][T11595] dump_stack_lvl+0x189/0x250 [ 586.665243][T11595] ? __pfx____ratelimit+0x10/0x10 [ 586.665269][T11595] ? __pfx_dump_stack_lvl+0x10/0x10 [ 586.665285][T11595] ? __pfx__printk+0x10/0x10 [ 586.665303][T11595] ? __might_fault+0xb0/0x130 [ 586.665340][T11595] should_fail_ex+0x414/0x560 [ 586.665369][T11595] _copy_from_user+0x2d/0xb0 [ 586.665390][T11595] kstrtouint_from_user+0xc4/0x170 [ 586.665417][T11595] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 586.665459][T11595] proc_fail_nth_write+0x88/0x240 [ 586.665477][T11595] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 586.665502][T11595] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 586.665562][T11595] vfs_write+0x27e/0xa90 [ 586.665596][T11595] ? __pfx_vfs_write+0x10/0x10 [ 586.665621][T11595] ? __fget_files+0x2a/0x420 [ 586.665642][T11595] ? __fget_files+0x3a0/0x420 [ 586.665657][T11595] ? __fget_files+0x2a/0x420 [ 586.665683][T11595] ksys_write+0x145/0x250 [ 586.665710][T11595] ? __pfx_ksys_write+0x10/0x10 [ 586.665728][T11595] ? rcu_is_watching+0x15/0xb0 [ 586.665754][T11595] ? do_syscall_64+0xbe/0x3b0 [ 586.665776][T11595] do_syscall_64+0xfa/0x3b0 [ 586.665794][T11595] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.665811][T11595] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 586.665828][T11595] ? clear_bhb_loop+0x60/0xb0 [ 586.665850][T11595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.665867][T11595] RIP: 0033:0x7fc3fd98d3df [ 586.665883][T11595] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 586.665898][T11595] RSP: 002b:00007fc3fe75c030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 586.665917][T11595] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc3fd98d3df [ 586.665930][T11595] RDX: 0000000000000001 RSI: 00007fc3fe75c0a0 RDI: 0000000000000004 [ 586.665941][T11595] RBP: 00007fc3fe75c090 R08: 0000000000000000 R09: 0000000000000000 [ 586.665951][T11595] R10: 0000000000001000 R11: 0000000000000293 R12: 0000000000000001 [ 586.665962][T11595] R13: 0000000000000000 R14: 00007fc3fdbb5fa0 R15: 00007ffd2005fd68 [ 586.665994][T11595] [ 586.948644][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 587.081210][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 587.195166][T11600] No control pipe specified [ 587.378724][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 587.789453][T11602] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1443'. [ 587.833580][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 587.858664][T11602] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1443'. [ 587.981561][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 588.169312][T11619] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 588.420737][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 589.530899][T11637] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1450'. [ 590.087640][T11641] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 590.404196][T11646] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1454'. [ 590.651562][T11655] No control pipe specified [ 591.141723][ T3559] net_ratelimit: 7 callbacks suppressed [ 591.141763][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 591.320209][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 591.442104][ T5841] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 591.479619][T11665] ip_vti0: entered allmulticast mode [ 591.505050][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 592.170667][ T5841] usb 2-1: Using ep0 maxpacket: 16 [ 592.209057][ T5841] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 592.234348][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 592.260602][ T5841] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 592.292012][ T5841] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 592.318795][ T5841] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 592.401153][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 592.523888][ T5841] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 592.534692][ T5841] usb 2-1: config 1 interface 0 has no altsetting 0 [ 592.541638][ T5841] usb 2-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 592.544253][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 592.557776][ T5841] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 592.589623][ T5841] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 592.805746][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 593.040961][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 593.200762][ T5841] scsi host1: usb-storage 2-1:1.0 [ 593.283802][T11686] sg_write: data in/out 524252/17 bytes for SCSI command 0x1-- guessing data in; [ 593.283802][T11686] program syz.2.1459 not setting count and/or reply_len properly [ 593.313581][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 593.371137][T11660] kAFS: No cell specified [ 593.383406][T10325] usb 2-1: USB disconnect, device number 28 [ 593.441502][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 594.647767][T11700] fuse: Unknown parameter 'fd0x0000000000000004' [ 594.807545][T11706] No control pipe specified [ 595.484268][T11713] netlink: 'syz.1.1471': attribute type 16 has an invalid length. [ 595.492226][T11713] netlink: 'syz.1.1471': attribute type 3 has an invalid length. [ 595.500178][T11713] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1471'. [ 596.156159][ T3559] net_ratelimit: 16 callbacks suppressed [ 596.156180][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 596.283199][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 596.655442][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 597.354336][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 597.414884][T11740] fuse: Unknown parameter 'fd0x0000000000000004' [ 597.480781][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 597.612084][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 597.662227][T11747] netlink: 'syz.1.1483': attribute type 21 has an invalid length. [ 597.681281][T11749] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 597.694460][T11749] netlink: 'syz.3.1484': attribute type 16 has an invalid length. [ 597.703191][T11749] netlink: 'syz.3.1484': attribute type 3 has an invalid length. [ 597.711219][T11749] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1484'. [ 598.439097][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 598.456541][T11746] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1482'. [ 598.671033][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 598.840652][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 598.960793][ T3559] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 600.203391][T11755] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 600.210902][T11755] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 600.573588][T11759] vhci_hcd: connection closed [ 600.581436][T11755] vhci_hcd vhci_hcd.0: Device attached [ 600.642393][T11627] vhci_hcd: stop threads [ 600.667448][T11627] vhci_hcd: release socket [ 600.691493][T11627] vhci_hcd: disconnect device [ 600.753596][ T9] vhci_hcd: vhci_device speed not set [ 600.927113][T11781] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1492'. [ 600.941598][T11782] fuse: Unknown parameter 'fd0x0000000000000004' [ 601.009636][ T43] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 601.227811][ T3508] net_ratelimit: 15 callbacks suppressed [ 601.227831][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 601.260937][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 601.311280][ T43] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 601.340186][ T43] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 601.366282][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 601.400068][ T43] usb 2-1: Product: syz [ 601.429107][T11790] trusted_key: encrypted_key: insufficient parameters specified [ 601.439905][ T43] usb 2-1: Manufacturer: syz [ 601.450563][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 601.458086][ T43] usb 2-1: SerialNumber: syz [ 601.501780][ T43] usb 2-1: config 0 descriptor?? [ 601.528367][ T43] streamzap 2-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 601.593648][T11627] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 601.645840][T11794] netlink: 'syz.3.1498': attribute type 21 has an invalid length. [ 601.725478][T11771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 601.726575][T11627] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 601.765891][T11771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 601.860238][T11800] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 601.884319][T11800] netlink: 'syz.0.1500': attribute type 16 has an invalid length. [ 601.894248][T11800] netlink: 'syz.0.1500': attribute type 3 has an invalid length. [ 601.903121][T11800] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1500'. [ 602.589632][ T9] usb 2-1: USB disconnect, device number 29 [ 602.860668][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 602.992329][T11797] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1499'. [ 603.016784][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 603.134811][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 603.271317][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 603.344478][T11821] /dev/nullb0: Can't open blockdev [ 604.153627][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 606.153466][T11837] lo speed is unknown, defaulting to 1000 [ 606.601167][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 606.631448][T11843] netlink: 'syz.2.1511': attribute type 21 has an invalid length. [ 606.640025][T11845] FAULT_INJECTION: forcing a failure. [ 606.640025][T11845] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 606.803243][T11845] CPU: 0 UID: 0 PID: 11845 Comm: syz.0.1514 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 606.803272][T11845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 606.803282][T11845] Call Trace: [ 606.803291][T11845] [ 606.803299][T11845] dump_stack_lvl+0x189/0x250 [ 606.803322][T11845] ? irqentry_exit+0x74/0x90 [ 606.803339][T11845] ? __pfx_dump_stack_lvl+0x10/0x10 [ 606.803359][T11845] should_fail_ex+0x414/0x560 [ 606.803377][T11845] _copy_from_user+0x2d/0xb0 [ 606.803389][T11845] memdup_user+0x5e/0xd0 [ 606.803401][T11845] strndup_user+0x68/0xd0 [ 606.803412][T11845] __se_sys_mount+0x9c/0x410 [ 606.803422][T11845] ? ksys_write+0x22a/0x250 [ 606.803436][T11845] ? __pfx___se_sys_mount+0x10/0x10 [ 606.803444][T11845] ? rcu_is_watching+0x15/0xb0 [ 606.803457][T11845] ? do_syscall_64+0xbe/0x3b0 [ 606.803465][T11845] ? __x64_sys_mount+0x20/0xc0 [ 606.803475][T11845] do_syscall_64+0xfa/0x3b0 [ 606.803484][T11845] ? lockdep_hardirqs_on+0x9c/0x150 [ 606.803496][T11845] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.803506][T11845] ? clear_bhb_loop+0x60/0xb0 [ 606.803518][T11845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.803527][T11845] RIP: 0033:0x7f4a2878e929 [ 606.803536][T11845] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 606.803544][T11845] RSP: 002b:00007f4a296d7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 606.803557][T11845] RAX: ffffffffffffffda RBX: 00007f4a289b5fa0 RCX: 00007f4a2878e929 [ 606.803564][T11845] RDX: 00002000000000c0 RSI: 0000200000000280 RDI: 0000200000000040 [ 606.803571][T11845] RBP: 00007f4a296d7090 R08: 0000000000000000 R09: 0000000000000000 [ 606.803578][T11845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 606.803583][T11845] R13: 0000000000000000 R14: 00007f4a289b5fa0 R15: 00007ffcbce79c78 [ 606.803599][T11845] [ 606.826708][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 608.752937][T11868] netlink: 4452 bytes leftover after parsing attributes in process `syz.2.1522'. [ 610.130992][T11880] netlink: 'syz.3.1526': attribute type 21 has an invalid length. [ 610.139351][T11876] trusted_key: encrypted_key: insufficient parameters specified [ 610.164707][T11876] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1524'. [ 610.191442][T11876] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 610.228711][T11876] VFS: Can't find a romfs filesystem on dev nullb0. [ 610.228711][T11876] [ 610.301908][ T9] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 610.310924][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 610.311618][T11879] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1525'. [ 610.490859][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 610.515334][ T9] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 610.536297][ T9] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 610.553077][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.564135][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 610.589304][ T9] usb 2-1: Product: syz [ 610.596194][ T9] usb 2-1: Manufacturer: syz [ 610.619176][ T9] usb 2-1: SerialNumber: syz [ 610.658761][ T9] usb 2-1: config 0 descriptor?? [ 610.694704][ T9] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 610.723666][ T9] usb 2-1: setting power ON [ 610.735125][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 610.752755][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 610.808382][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 610.893126][T11874] dvb-usb: bulk message failed: -22 (3/0) [ 610.900436][T11874] dvb-usb: bulk message failed: -22 (37/0) [ 610.914995][T11874] FAULT_INJECTION: forcing a failure. [ 610.914995][T11874] name failslab, interval 1, probability 0, space 0, times 0 [ 610.918373][ T9] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 610.955007][T11874] CPU: 1 UID: 0 PID: 11874 Comm: syz.1.1523 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 610.955035][T11874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 610.955043][T11874] Call Trace: [ 610.955050][T11874] [ 610.955057][T11874] dump_stack_lvl+0x189/0x250 [ 610.955081][T11874] ? __pfx____ratelimit+0x10/0x10 [ 610.955104][T11874] ? __pfx_dump_stack_lvl+0x10/0x10 [ 610.955121][T11874] ? __pfx__printk+0x10/0x10 [ 610.955145][T11874] ? __pfx___might_resched+0x10/0x10 [ 610.955163][T11874] ? fs_reclaim_acquire+0x7d/0x100 [ 610.955184][T11874] should_fail_ex+0x414/0x560 [ 610.955211][T11874] should_failslab+0xa8/0x100 [ 610.955236][T11874] __kmalloc_noprof+0xcb/0x4f0 [ 610.955256][T11874] ? i2cdev_ioctl_rdwr+0xce/0x740 [ 610.955283][T11874] i2cdev_ioctl_rdwr+0xce/0x740 [ 610.955314][T11874] i2cdev_ioctl+0x64b/0x7f0 [ 610.955333][T11874] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 610.955355][T11874] ? __fget_files+0x3a0/0x420 [ 610.955369][T11874] ? __fget_files+0x2a/0x420 [ 610.955387][T11874] ? bpf_lsm_file_ioctl+0x9/0x20 [ 610.955403][T11874] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 610.955424][T11874] __se_sys_ioctl+0xfc/0x170 [ 610.955445][T11874] do_syscall_64+0xfa/0x3b0 [ 610.955458][T11874] ? lockdep_hardirqs_on+0x9c/0x150 [ 610.955478][T11874] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.955494][T11874] ? clear_bhb_loop+0x60/0xb0 [ 610.955512][T11874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.955526][T11874] RIP: 0033:0x7fc3fd98e929 [ 610.955541][T11874] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 610.955553][T11874] RSP: 002b:00007fc3fe75c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 610.955570][T11874] RAX: ffffffffffffffda RBX: 00007fc3fdbb5fa0 RCX: 00007fc3fd98e929 [ 610.955582][T11874] RDX: 0000200000000040 RSI: 0000000000000707 RDI: 0000000000000005 [ 610.955592][T11874] RBP: 00007fc3fe75c090 R08: 0000000000000000 R09: 0000000000000000 [ 610.955601][T11874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 610.955610][T11874] R13: 0000000000000000 R14: 00007fc3fdbb5fa0 R15: 00007ffd2005fd68 [ 610.955635][T11874] [ 610.979431][ T9] usb 2-1: media controller created [ 610.984264][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 611.357079][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 611.500669][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 611.508857][ T9] usb 2-1: selecting invalid altsetting 6 [ 611.522808][ T9] usb 2-1: digital interface selection failed (-22) [ 611.534202][ T9] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 611.545860][ T9] usb 2-1: setting power OFF [ 611.550952][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 611.562598][ T9] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 611.637741][ T9] (NULL device *): no alternate interface [ 611.661923][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 611.729292][ T9] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 611.776667][T11902] 9pnet_fd: Insufficient options for proto=fd [ 611.830946][ T9] usb 2-1: USB disconnect, device number 30 [ 611.859911][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 611.993128][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 611.993408][T11902] overlayfs: failed to resolve './file1': -2 [ 612.132376][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 612.357129][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 612.374605][ T9] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 612.386375][ T9] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 612.491059][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 612.610676][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 612.741487][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 612.931192][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 613.202431][T11916] netlink: 'syz.2.1537': attribute type 21 has an invalid length. [ 613.223781][T11911] fido_id[11911]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 613.419311][T11918] /dev/nullb0: Can't open blockdev [ 613.436452][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 615.275079][T11944] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 615.287089][T11944] netlink: 'syz.0.1547': attribute type 16 has an invalid length. [ 615.295429][T11944] netlink: 'syz.0.1547': attribute type 3 has an invalid length. [ 615.303917][T11944] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1547'. [ 615.758104][T11950] netlink: 'syz.5.1548': attribute type 21 has an invalid length. [ 616.240869][ T24] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 616.306526][T11956] fuse: Bad value for 'user_id' [ 616.311991][T11956] fuse: Bad value for 'user_id' [ 616.548002][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 616.579839][ T24] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 616.604117][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 616.639061][ T24] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 616.655419][ T5957] hid-generic 0000:0000:0000.0010: unknown main item tag 0x0 [ 616.673866][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.697962][ T5957] hid-generic 0000:0000:0000.0010: hidraw0: HID v0.00 Device [syz1] on syz0 [ 616.705699][ T24] usb 3-1: Product: syz [ 616.723300][ T8282] net_ratelimit: 16 callbacks suppressed [ 616.723316][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 616.784226][ T24] usb 3-1: Manufacturer: syz [ 616.789618][ T24] usb 3-1: SerialNumber: syz [ 616.883410][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 616.892766][ T24] usb 3-1: config 0 descriptor?? [ 616.928005][T11955] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 616.962385][T11955] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 616.985205][ T24] usb 3-1: ucan: probing device on interface #0 [ 617.036005][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 617.180877][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 617.192326][ T24] usb 3-1: ucan: device protocol version 7496963 is not supported [ 617.238305][T11969] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 617.260742][ T24] usb 3-1: ucan: probe failed; try to update the device firmware [ 617.321917][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 618.363567][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 618.771299][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 618.800636][T10325] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 618.963579][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 619.042538][T10325] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 619.091776][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 619.146461][T11986] netlink: 'syz.1.1559': attribute type 21 has an invalid length. [ 619.213158][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 619.238883][T10325] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 619.248837][T10325] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.259906][T10325] usb 4-1: config 0 descriptor?? [ 619.297321][T10325] pwc: Askey VC010 type 2 USB webcam detected. [ 620.227154][ T5841] usb 3-1: USB disconnect, device number 24 [ 620.250599][ T9] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 620.440554][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 620.455608][T11995] fuse: Bad value for 'user_id' [ 620.460942][T11995] fuse: Bad value for 'user_id' [ 620.519856][ T9] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 620.922326][ T9] usb 2-1: config 179 has no interface number 0 [ 621.132219][ T9] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 621.149230][ T9] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 621.162779][ T9] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 621.956894][ T9] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 621.970040][ T49] net_ratelimit: 11 callbacks suppressed [ 621.970071][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 622.170833][ T9] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 622.184973][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.216963][T10325] pwc: recv_control_msg error -71 req 02 val 2700 [ 622.235802][T11989] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 622.262512][T10325] pwc: recv_control_msg error -71 req 02 val 2c00 [ 622.271871][T10325] pwc: recv_control_msg error -71 req 04 val 1000 [ 622.291120][T10325] pwc: recv_control_msg error -71 req 04 val 1300 [ 622.300727][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 622.301340][T10325] pwc: recv_control_msg error -71 req 04 val 1400 [ 622.317726][T10325] pwc: recv_control_msg error -71 req 02 val 2000 [ 622.324892][T10325] pwc: recv_control_msg error -71 req 02 val 2100 [ 622.332127][T10325] pwc: recv_control_msg error -71 req 04 val 1500 [ 622.339187][T10325] pwc: recv_control_msg error -71 req 02 val 2500 [ 622.346449][T10325] pwc: recv_control_msg error -71 req 02 val 2400 [ 622.354075][T10325] pwc: recv_control_msg error -71 req 02 val 2600 [ 622.361385][T10325] pwc: recv_control_msg error -71 req 02 val 2900 [ 622.370664][T10325] pwc: recv_control_msg error -71 req 02 val 2800 [ 622.378273][T10325] pwc: recv_control_msg error -71 req 04 val 1100 [ 622.418887][ T9] usb 2-1: USB disconnect, device number 31 [ 622.531670][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 622.555025][T10325] pwc: recv_control_msg error -71 req 04 val 1200 [ 622.748839][T11627] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 622.749394][T10325] pwc: Registered as video103. [ 622.786858][T10325] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input25 [ 622.845283][T12012] nft_compat: unsupported protocol 1 [ 623.121019][T11627] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 623.221198][T10325] usb 4-1: USB disconnect, device number 26 [ 623.365158][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 623.511063][ T9] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 623.526842][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 623.746647][T10325] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 624.192827][ T5957] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 624.220556][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 624.248892][ T5957] hid-generic 0000:0000:0000.0011: hidraw0: HID v0.00 Device [syz1] on syz0 [ 624.310820][T10325] usb 4-1: Using ep0 maxpacket: 8 [ 624.320985][ T9] usb 6-1: device descriptor read/64, error -71 [ 624.330724][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 624.372764][T10325] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 624.556987][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.568947][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.629075][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 624.682667][ T9] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 624.690635][T10325] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 624.983881][T10325] pvrusb2: Hardware description: Terratec Grabster AV400 [ 625.039243][T10325] pvrusb2: ********** [ 625.054265][T10325] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 625.084791][T10325] pvrusb2: Important functionality might not be entirely working. [ 625.100679][ T9] usb 6-1: device descriptor read/64, error -71 [ 625.121334][T10325] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 625.210712][T10325] pvrusb2: ********** [ 625.229093][ T9] usb usb6-port1: attempt power cycle [ 625.254402][ T2344] pvrusb2: Invalid write control endpoint [ 625.504370][T12007] pvrusb2: Invalid write control endpoint [ 625.808361][ T5957] usb 4-1: USB disconnect, device number 27 [ 625.883565][ T2344] pvrusb2: Invalid write control endpoint [ 625.891478][ T9] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 625.910855][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 625.960550][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 625.968276][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 626.013669][ T2344] pvrusb2: Device being rendered inoperable [ 626.019787][ T9] usb 6-1: device descriptor read/8, error -71 [ 626.053338][ T2344] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 626.081023][ T2344] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 626.087770][T12044] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 626.108385][ T2344] pvrusb2: Attached sub-driver cx25840 [ 626.129676][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 626.174722][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 627.057437][T11853] net_ratelimit: 18 callbacks suppressed [ 627.057475][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 627.246577][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 627.381374][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 627.419438][T12074] FAULT_INJECTION: forcing a failure. [ 627.419438][T12074] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 627.437693][T12074] CPU: 1 UID: 0 PID: 12074 Comm: syz.5.1582 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 627.437722][T12074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 627.437732][T12074] Call Trace: [ 627.437740][T12074] [ 627.437748][T12074] dump_stack_lvl+0x189/0x250 [ 627.437774][T12074] ? __pfx____ratelimit+0x10/0x10 [ 627.437799][T12074] ? __pfx_dump_stack_lvl+0x10/0x10 [ 627.437818][T12074] ? __pfx__printk+0x10/0x10 [ 627.437840][T12074] ? __might_fault+0xb0/0x130 [ 627.437875][T12074] should_fail_ex+0x414/0x560 [ 627.437904][T12074] _copy_from_iter+0x1db/0x16f0 [ 627.437927][T12074] ? rcu_is_watching+0x15/0xb0 [ 627.437948][T12074] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 627.437972][T12074] ? __pfx__copy_from_iter+0x10/0x10 [ 627.437992][T12074] ? __build_skb_around+0x257/0x3e0 [ 627.438015][T12074] ? netlink_sendmsg+0x642/0xb30 [ 627.438033][T12074] ? skb_put+0x11b/0x210 [ 627.438056][T12074] netlink_sendmsg+0x6b2/0xb30 [ 627.438082][T12074] ? __pfx_netlink_sendmsg+0x10/0x10 [ 627.438111][T12074] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 627.438130][T12074] ? __pfx_netlink_sendmsg+0x10/0x10 [ 627.438149][T12074] __sock_sendmsg+0x219/0x270 [ 627.438184][T12074] ____sys_sendmsg+0x505/0x830 [ 627.438210][T12074] ? __pfx_____sys_sendmsg+0x10/0x10 [ 627.438241][T12074] ? import_iovec+0x74/0xa0 [ 627.438265][T12074] ___sys_sendmsg+0x21f/0x2a0 [ 627.438288][T12074] ? __pfx____sys_sendmsg+0x10/0x10 [ 627.438343][T12074] ? __fget_files+0x2a/0x420 [ 627.438357][T12074] ? __fget_files+0x3a0/0x420 [ 627.438381][T12074] __x64_sys_sendmsg+0x19b/0x260 [ 627.438401][T12074] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 627.438442][T12074] ? __pfx_ksys_write+0x10/0x10 [ 627.438462][T12074] ? rcu_is_watching+0x15/0xb0 [ 627.438485][T12074] ? do_syscall_64+0xbe/0x3b0 [ 627.438505][T12074] do_syscall_64+0xfa/0x3b0 [ 627.438520][T12074] ? lockdep_hardirqs_on+0x9c/0x150 [ 627.438542][T12074] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 627.438560][T12074] ? clear_bhb_loop+0x60/0xb0 [ 627.438581][T12074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 627.438597][T12074] RIP: 0033:0x7fb478f8e929 [ 627.438619][T12074] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 627.438632][T12074] RSP: 002b:00007fb479d56038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 627.438651][T12074] RAX: ffffffffffffffda RBX: 00007fb4791b5fa0 RCX: 00007fb478f8e929 [ 627.438663][T12074] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 627.438674][T12074] RBP: 00007fb479d56090 R08: 0000000000000000 R09: 0000000000000000 [ 627.438683][T12074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 627.438692][T12074] R13: 0000000000000000 R14: 00007fb4791b5fa0 R15: 00007ffd99633738 [ 627.438721][T12074] [ 627.732189][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 627.869649][T12076] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1583'. [ 627.881380][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 628.729335][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 628.941264][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 629.093084][T12086] netlink: 'syz.5.1585': attribute type 1 has an invalid length. [ 629.125701][T12086] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1585'. [ 629.135658][T11627] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 629.205639][ T43] kernel write not supported for file /814/loginuid (pid: 43 comm: kworker/1:1) [ 629.250880][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 629.297803][T12095] netlink: 'syz.2.1589': attribute type 9 has an invalid length. [ 629.322134][T12095] netlink: 'syz.2.1589': attribute type 9 has an invalid length. [ 629.390852][T11627] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 629.436516][ T43] hid-generic 0000:0000:0000.0012: unknown main item tag 0x0 [ 629.470740][T10325] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 629.498283][ T43] hid-generic 0000:0000:0000.0012: hidraw0: HID v0.00 Device [syz1] on syz0 [ 629.693165][T10325] usb 6-1: unable to get BOS descriptor or descriptor too short [ 629.713536][T10325] usb 6-1: not running at top speed; connect to a high speed hub [ 629.731864][T10325] usb 6-1: config 8 has an invalid interface number: 24 but max is 0 [ 629.788848][T10325] usb 6-1: config 8 has no interface number 0 [ 629.819504][T10325] usb 6-1: config 8 interface 24 altsetting 2 endpoint 0xE has invalid maxpacket 1535, setting to 64 [ 629.883357][T10325] usb 6-1: config 8 interface 24 altsetting 2 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 629.956945][T10325] usb 6-1: config 8 interface 24 altsetting 2 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 629.968654][T10325] usb 6-1: config 8 interface 24 has no altsetting 0 [ 629.978631][T10325] usb 6-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=75.af [ 629.988289][T10325] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 629.997424][T10325] usb 6-1: Product: syz [ 630.001890][T10325] usb 6-1: Manufacturer: syz [ 630.007001][T10325] usb 6-1: SerialNumber: syz [ 630.306176][T12086] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 630.409390][T12086] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 630.727988][ T5957] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 630.917170][ T5957] usb 1-1: Using ep0 maxpacket: 32 [ 630.972082][ T5957] usb 1-1: config 0 has an invalid interface number: 57 but max is 1 [ 631.033151][ T5957] usb 1-1: config 0 has an invalid interface number: 180 but max is 1 [ 631.044805][ T5957] usb 1-1: config 0 has no interface number 0 [ 631.057367][ T5957] usb 1-1: config 0 has no interface number 1 [ 631.106589][ T5957] usb 1-1: config 0 interface 57 has no altsetting 0 [ 631.116257][ T5957] usb 1-1: config 0 interface 180 has no altsetting 0 [ 631.182959][ T5957] usb 1-1: New USB device found, idVendor=1391, idProduct=1000, bcdDevice=ba.2f [ 631.200594][ T5957] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 631.222300][ T5957] usb 1-1: Product: syz [ 631.237614][ T5957] usb 1-1: Manufacturer: syz [ 631.261098][ T5957] usb 1-1: SerialNumber: syz [ 631.488048][ T5957] usb 1-1: config 0 descriptor?? [ 632.256611][ T12] net_ratelimit: 21 callbacks suppressed [ 632.256640][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 632.566377][ T5957] usb 1-1: USB disconnect, device number 25 [ 632.681648][T11627] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 632.807471][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 632.885101][T10325] comedi comedi5: driver 'vmk80xx' has successfully auto-configured 'K8055 (VM110)'. [ 633.100821][T11627] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.261034][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.480842][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.660089][T10325] usb 6-1: USB disconnect, device number 29 [ 633.692679][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.838888][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 634.000582][ T24] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 634.015361][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 634.189263][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 634.790579][T10325] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 634.842760][ T24] usb 3-1: config 0 has an invalid descriptor of length 245, skipping remainder of the config [ 634.865178][ T24] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 634.891294][ T24] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 634.910790][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.940695][ T24] usb 3-1: Product: syz [ 634.948644][ T24] usb 3-1: Manufacturer: syz [ 634.960558][T10325] usb 2-1: Using ep0 maxpacket: 8 [ 634.983468][T10325] usb 2-1: config 2 has an invalid interface number: 31 but max is 0 [ 635.001416][ T24] usb 3-1: SerialNumber: syz [ 635.006226][T10325] usb 2-1: config 2 has no interface number 0 [ 635.019997][ T9] hid-generic 0000:0000:0000.0013: unknown main item tag 0x0 [ 635.028467][T10325] usb 2-1: config 2 interface 31 has no altsetting 0 [ 635.043504][ T24] usb 3-1: config 0 descriptor?? [ 635.086243][T10325] usb 2-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 635.086794][ T9] hid-generic 0000:0000:0000.0013: hidraw0: HID v0.00 Device [syz1] on syz0 [ 635.127417][T10325] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.184242][T10325] usb 2-1: Product: syz [ 635.205422][T10325] usb 2-1: Manufacturer: syz [ 635.230242][T10325] usb 2-1: SerialNumber: syz [ 635.943521][T10325] ch9200 2-1:2.31: probe with driver ch9200 failed with error -22 [ 636.704538][ T5957] usb 3-1: USB disconnect, device number 25 [ 636.731223][T10325] usb 2-1: USB disconnect, device number 32 [ 637.264641][ T49] net_ratelimit: 14 callbacks suppressed [ 637.264790][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 637.400741][ T5900] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 637.778927][T12206] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1619'. [ 637.796195][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 637.799223][T12206] netlink: 'syz.3.1619': attribute type 1 has an invalid length. [ 637.811996][T12206] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1619'. [ 637.952980][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 638.141631][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 638.343428][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 638.390638][ T5900] usb 3-1: Using ep0 maxpacket: 16 [ 638.399938][ T5900] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 638.421346][ T5900] usb 3-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=19.82 [ 638.435353][T10325] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 638.444014][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.452446][ T5900] usb 3-1: Product: syz [ 638.457449][ T5900] usb 3-1: Manufacturer: syz [ 638.462321][ T5900] usb 3-1: SerialNumber: syz [ 638.491652][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 638.587671][ T5900] usb 3-1: config 0 descriptor?? [ 638.605153][ T5900] kobil_sct 3-1:0.0: required endpoints missing [ 638.623022][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 638.640558][T10325] usb 2-1: device descriptor read/64, error -71 [ 638.808882][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 638.994664][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 639.040641][T10325] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 639.414787][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 639.631873][ T5957] usb 3-1: USB disconnect, device number 26 [ 640.686365][T12229] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1624'. [ 642.839681][T11853] net_ratelimit: 15 callbacks suppressed [ 642.839735][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 642.974384][ T5957] hid-generic 0000:0000:0000.0014: unknown main item tag 0x0 [ 642.982286][T12256] input: syz0 as /devices/virtual/input/input26 [ 643.010823][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 643.037537][ T5957] hid-generic 0000:0000:0000.0014: hidraw0: HID v0.00 Device [syz1] on syz0 [ 643.140779][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 643.251545][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 643.310650][T12262] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 643.321175][T12262] netlink: 'syz.5.1632': attribute type 16 has an invalid length. [ 643.329103][T12262] netlink: 'syz.5.1632': attribute type 3 has an invalid length. [ 643.337006][T12262] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1632'. [ 644.144563][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.224514][T12265] kvm: MWAIT instruction emulated as NOP! [ 644.285669][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.368283][T12265] fuse: Bad value for 'group_id' [ 644.391536][T12265] fuse: Bad value for 'group_id' [ 644.438243][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.560689][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.726814][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.952613][ T5957] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 645.011414][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 645.210782][ T5957] usb 6-1: Using ep0 maxpacket: 8 [ 645.280782][ T5957] usb 6-1: unable to get BOS descriptor or descriptor too short [ 645.397106][ T5957] usb 6-1: config 7 has an invalid interface number: 67 but max is 0 [ 645.492412][ T5957] usb 6-1: config 7 has no interface number 0 [ 645.540830][ T5957] usb 6-1: language id specifier not provided by device, defaulting to English [ 645.566449][ T5957] usb 6-1: New USB device found, idVendor=16c0, idProduct=05df, bcdDevice=6b.16 [ 645.590976][ T5957] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.650565][ T5957] usb 6-1: Product: syz [ 645.654901][ T5957] usb 6-1: SerialNumber: syz [ 645.970286][ T5957] usb 6-1: USB disconnect, device number 30 [ 647.010908][T12302] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 647.022070][T12302] netlink: 'syz.2.1642': attribute type 16 has an invalid length. [ 647.030064][T12302] netlink: 'syz.2.1642': attribute type 3 has an invalid length. [ 647.038000][T12302] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1642'. [ 647.880626][ T3013] net_ratelimit: 16 callbacks suppressed [ 647.880647][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 647.984500][T12308] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 647.995118][T12308] netlink: 'syz.5.1643': attribute type 16 has an invalid length. [ 648.003105][T12308] netlink: 'syz.5.1643': attribute type 3 has an invalid length. [ 648.010919][T12308] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1643'. [ 649.040373][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 649.150777][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 649.434564][T12319] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 649.454710][T12319] netlink: 'syz.2.1644': attribute type 16 has an invalid length. [ 649.463092][T12319] netlink: 'syz.2.1644': attribute type 3 has an invalid length. [ 649.471333][T12319] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1644'. [ 649.627334][ T3508] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 649.905556][T12321] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1645'. [ 650.301812][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 650.492220][ T5900] hid-generic 0000:0000:0000.0015: unknown main item tag 0x0 [ 650.513863][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 650.572700][ T5900] hid-generic 0000:0000:0000.0015: hidraw0: HID v0.00 Device [syz1] on syz0 [ 650.841384][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 650.963850][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 651.835237][ T36] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 652.045250][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 652.903435][T12358] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1656'. [ 653.009484][ T8282] net_ratelimit: 5 callbacks suppressed [ 653.460662][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 653.612724][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 653.654667][T12366] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 653.665727][T12366] netlink: 'syz.1.1657': attribute type 16 has an invalid length. [ 653.673869][T12366] netlink: 'syz.1.1657': attribute type 3 has an invalid length. [ 653.681883][T12366] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1657'. [ 653.726997][ T3013] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 654.391200][T12364] FAULT_INJECTION: forcing a failure. [ 654.391200][T12364] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 654.404724][T12364] CPU: 0 UID: 0 PID: 12364 Comm: syz.3.1660 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 654.404748][T12364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 654.404757][T12364] Call Trace: [ 654.404764][T12364] [ 654.404771][T12364] dump_stack_lvl+0x189/0x250 [ 654.404792][T12364] ? irqentry_exit+0x74/0x90 [ 654.404819][T12364] ? __pfx_dump_stack_lvl+0x10/0x10 [ 654.404867][T12364] should_fail_ex+0x414/0x560 [ 654.404896][T12364] _copy_from_user+0x2d/0xb0 [ 654.404917][T12364] __sys_bind+0x199/0x3e0 [ 654.404940][T12364] ? __pfx___sys_bind+0x10/0x10 [ 654.404970][T12364] ? __pfx_ksys_write+0x10/0x10 [ 654.404990][T12364] ? rcu_is_watching+0x15/0xb0 [ 654.405016][T12364] __x64_sys_bind+0x7a/0x90 [ 654.405042][T12364] do_syscall_64+0xfa/0x3b0 [ 654.405060][T12364] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.405076][T12364] ? asm_sysvec_call_function_single+0x1a/0x20 [ 654.405092][T12364] ? clear_bhb_loop+0x60/0xb0 [ 654.405117][T12364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.405134][T12364] RIP: 0033:0x7f6f0298e929 [ 654.405150][T12364] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 654.405165][T12364] RSP: 002b:00007f6f03891038 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 654.405183][T12364] RAX: ffffffffffffffda RBX: 00007f6f02bb6080 RCX: 00007f6f0298e929 [ 654.405196][T12364] RDX: 0000000000000010 RSI: 00002000000000c0 RDI: 000000000000000a [ 654.405207][T12364] RBP: 00007f6f03891090 R08: 0000000000000000 R09: 0000000000000000 [ 654.405218][T12364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 654.405229][T12364] R13: 0000000000000000 R14: 00007f6f02bb6080 R15: 00007ffd58e74308 [ 654.405258][T12364] [ 654.623634][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 654.941584][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 655.061343][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 655.173841][T11853] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 655.333944][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 655.491051][ T8282] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 655.534259][T12400] autofs4:pid:12400:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(1.4), cmd(0xc018937e) [ 655.585536][T12397] binder: 12396:12397 unknown command 0 [ 655.587635][T12400] autofs4:pid:12400:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc018937e) [ 655.591398][T12397] binder: 12396:12397 ioctl c0306201 200000000480 returned -22 [ 655.614159][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 655.673876][T12403] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1665'. [ 655.809980][ T5957] hid-generic 0000:0000:0000.0016: unknown main item tag 0x0 [ 656.132496][ T5957] hid-generic 0000:0000:0000.0016: hidraw0: HID v0.00 Device [syz1] on syz0 [ 656.791149][ T5957] Process accounting resumed [ 657.561853][T12415] delete_channel: no stack [ 657.796890][ T24] IPVS: starting estimator thread 0... [ 657.932521][T12428] lo speed is unknown, defaulting to 1000 [ 657.955699][T12432] IPVS: using max 40 ests per chain, 96000 per kthread [ 657.973261][T12434] program syz.5.1676 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 658.231597][ T1146] net_ratelimit: 17 callbacks suppressed [ 658.231627][ T1146] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 658.381020][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 658.543750][T12450] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000 [ 658.573234][T12450] netlink: 'syz.5.1679': attribute type 16 has an invalid length. [ 658.581833][T12450] netlink: 'syz.5.1679': attribute type 3 has an invalid length. [ 658.589964][T12450] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1679'. [ 659.094320][ T49] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 659.345121][T12462] ------------[ cut here ]------------ [ 659.351296][T12462] WARNING: CPU: 0 PID: 12462 at mm/page_alloc.c:4935 __alloc_frozen_pages_noprof+0x2c8/0x370 [ 659.353594][T12453] lo speed is unknown, defaulting to 1000 [ 659.361674][T12462] Modules linked in: [ 659.372269][T12462] CPU: 0 UID: 0 PID: 12462 Comm: syz.1.1680 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 659.384428][T12462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 659.394608][T12462] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 659.401650][T12462] Code: 74 10 4c 89 e7 89 54 24 0c e8 14 14 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 4d 44 76 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 659.421376][T12462] RSP: 0018:ffffc90003eef960 EFLAGS: 00010246 [ 659.427475][T12462] RAX: ffffc90003eef900 RBX: 0000000000000019 RCX: 0000000000000000 [ 659.435935][T12462] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003eef9c8 [ 659.444334][T12462] RBP: ffffc90003eefa50 R08: ffffc90003eef9c7 R09: 0000000000000000 [ 659.452505][T12462] R10: ffffc90003eef9a0 R11: fffff520007ddf39 R12: 0000000000000000 [ 659.460594][T12462] R13: 1ffff920007ddf30 R14: 0000000000040dc0 R15: dffffc0000000000 [ 659.468616][T12462] FS: 00007fc3fe71a6c0(0000) GS:ffff888125c4f000(0000) knlGS:0000000000000000 [ 659.477678][T12462] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 659.484390][T12462] CR2: 0000200000104d40 CR3: 0000000064080000 CR4: 00000000003526f0 [ 659.492693][T12462] DR0: 0000000000000007 DR1: 0000000000004e6a DR2: 0000000000000007 [ 659.500883][T12462] DR3: 00000000000002d5 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 659.508953][T12462] Call Trace: [ 659.512535][T12462] [ 659.515476][T12462] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 659.521856][T12462] __alloc_pages_noprof+0xa/0x30 [ 659.526804][T12462] ___kmalloc_large_node+0x85/0x210 [ 659.532365][T12462] __kmalloc_large_node_noprof+0x18/0x90 [ 659.538363][T12462] __kmalloc_noprof+0x36f/0x4f0 [ 659.543399][T12462] ? comedi_unlocked_ioctl+0x9ee/0xf40 [ 659.548967][T12462] comedi_unlocked_ioctl+0x9ee/0xf40 [ 659.554320][T12462] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 659.560160][T12462] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 659.565878][T12462] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 659.571731][T12462] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 659.577387][T12462] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 659.583538][T12462] ? smack_log+0xef/0x3f0 [ 659.588340][T12462] ? __pfx_smack_log+0x10/0x10 [ 659.593242][T12462] ? smk_access+0x14c/0x4e0 [ 659.597755][T12462] ? smk_tskacc+0x2fc/0x370 [ 659.602724][T12462] ? smack_file_ioctl+0x2a9/0x340 [ 659.608134][T12462] ? __pfx_smack_file_ioctl+0x10/0x10 [ 659.613596][T12462] ? __fget_files+0x2a/0x420 [ 659.618238][T12462] ? __fget_files+0x3a0/0x420 [ 659.622985][T12462] ? __fget_files+0x2a/0x420 [ 659.627842][T12462] ? bpf_lsm_file_ioctl+0x9/0x20 [ 659.632818][T12462] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 659.638632][T12462] __se_sys_ioctl+0xfc/0x170 [ 659.643599][T12462] do_syscall_64+0xfa/0x3b0 [ 659.648112][T12462] ? lockdep_hardirqs_on+0x9c/0x150 [ 659.653601][T12462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.659701][T12462] ? clear_bhb_loop+0x60/0xb0 [ 659.664443][T12462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.670570][T12462] RIP: 0033:0x7fc3fd98e929 [ 659.675004][T12462] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 659.694659][T12462] RSP: 002b:00007fc3fe71a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 659.703106][T12462] RAX: ffffffffffffffda RBX: 00007fc3fdbb6160 RCX: 00007fc3fd98e929 [ 659.711424][T12462] RDX: 0000200000000000 RSI: 000000008010640b RDI: 000000000000000a [ 659.719401][T12462] RBP: 00007fc3fda10ca1 R08: 0000000000000000 R09: 0000000000000000 [ 659.727419][T12462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 659.735692][T12462] R13: 0000000000000000 R14: 00007fc3fdbb6160 R15: 00007ffd2005fd68 [ 659.744372][T12462] [ 659.747433][T12462] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 659.754989][T12462] CPU: 0 UID: 0 PID: 12462 Comm: syz.1.1680 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 659.767077][T12462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 659.777573][T12462] Call Trace: [ 659.780853][T12462] [ 659.783776][T12462] dump_stack_lvl+0x99/0x250 [ 659.788364][T12462] ? __asan_memcpy+0x40/0x70 [ 659.794746][T12462] ? __pfx_dump_stack_lvl+0x10/0x10 [ 659.800493][T12462] ? __pfx__printk+0x10/0x10 [ 659.805110][T12462] panic+0x2db/0x790 [ 659.809625][T12462] ? __pfx_panic+0x10/0x10 [ 659.815881][T12462] ? show_trace_log_lvl+0x4fb/0x550 [ 659.821650][T12462] __warn+0x31b/0x4b0 [ 659.825720][T12462] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 659.832246][T12462] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 659.838451][T12462] report_bug+0x2be/0x4f0 [ 659.842794][T12462] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 659.848966][T12462] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 659.855040][T12462] ? __alloc_frozen_pages_noprof+0x2ca/0x370 [ 659.861021][T12462] handle_bug+0x84/0x160 [ 659.865487][T12462] exc_invalid_op+0x1a/0x50 [ 659.870027][T12462] asm_exc_invalid_op+0x1a/0x20 [ 659.875054][T12462] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 659.881868][T12462] Code: 74 10 4c 89 e7 89 54 24 0c e8 14 14 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 4d 44 76 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 659.901857][T12462] RSP: 0018:ffffc90003eef960 EFLAGS: 00010246 [ 659.908023][T12462] RAX: ffffc90003eef900 RBX: 0000000000000019 RCX: 0000000000000000 [ 659.916389][T12462] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003eef9c8 [ 659.924619][T12462] RBP: ffffc90003eefa50 R08: ffffc90003eef9c7 R09: 0000000000000000 [ 659.932672][T12462] R10: ffffc90003eef9a0 R11: fffff520007ddf39 R12: 0000000000000000 [ 659.940636][T12462] R13: 1ffff920007ddf30 R14: 0000000000040dc0 R15: dffffc0000000000 [ 659.948881][T12462] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 659.955778][T12462] __alloc_pages_noprof+0xa/0x30 [ 659.961626][T12462] ___kmalloc_large_node+0x85/0x210 [ 659.967234][T12462] __kmalloc_large_node_noprof+0x18/0x90 [ 659.972909][T12462] __kmalloc_noprof+0x36f/0x4f0 [ 659.977860][T12462] ? comedi_unlocked_ioctl+0x9ee/0xf40 [ 659.983410][T12462] comedi_unlocked_ioctl+0x9ee/0xf40 [ 659.989219][T12462] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 659.995053][T12462] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 660.000704][T12462] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 660.006450][T12462] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 660.012224][T12462] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 660.018234][T12462] ? smack_log+0xef/0x3f0 [ 660.022591][T12462] ? __pfx_smack_log+0x10/0x10 [ 660.027475][T12462] ? smk_access+0x14c/0x4e0 [ 660.032613][T12462] ? smk_tskacc+0x2fc/0x370 [ 660.037311][T12462] ? smack_file_ioctl+0x2a9/0x340 [ 660.042425][T12462] ? __pfx_smack_file_ioctl+0x10/0x10 [ 660.047812][T12462] ? __fget_files+0x2a/0x420 [ 660.053280][T12462] ? __fget_files+0x3a0/0x420 [ 660.057970][T12462] ? __fget_files+0x2a/0x420 [ 660.062588][T12462] ? bpf_lsm_file_ioctl+0x9/0x20 [ 660.067611][T12462] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 660.073508][T12462] __se_sys_ioctl+0xfc/0x170 [ 660.078146][T12462] do_syscall_64+0xfa/0x3b0 [ 660.082642][T12462] ? lockdep_hardirqs_on+0x9c/0x150 [ 660.088010][T12462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.094508][T12462] ? clear_bhb_loop+0x60/0xb0 [ 660.099552][T12462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.105796][T12462] RIP: 0033:0x7fc3fd98e929 [ 660.110847][T12462] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 660.130834][T12462] RSP: 002b:00007fc3fe71a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 660.139240][T12462] RAX: ffffffffffffffda RBX: 00007fc3fdbb6160 RCX: 00007fc3fd98e929 [ 660.147339][T12462] RDX: 0000200000000000 RSI: 000000008010640b RDI: 000000000000000a [ 660.155334][T12462] RBP: 00007fc3fda10ca1 R08: 0000000000000000 R09: 0000000000000000 [ 660.163482][T12462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 660.171456][T12462] R13: 0000000000000000 R14: 00007fc3fdbb6160 R15: 00007ffd2005fd68 [ 660.179441][T12462] [ 660.182978][T12462] Kernel Offset: disabled [ 660.187296][T12462] Rebooting in 86400 seconds..